81

I work for a company in which the age of our average user is over 70. We have an app* that helps them collect and submit physiological data to their doctors.

I found this question that I believe is helpful if you're helping your mother set a password: Secure Memorable Passwords for Older Users

However, we're struggling to develop a policy for our 5000+ users, particularly given these additional wrinkles:

  • The users' accounts are set up at the doctor's office by a non-technical medical professional that probably thinks "Dog123" is a good password. We can educate them about password complexity, but getting them to similarly educate users on-site is a different ballgame.
  • Many of our users don't have an email address, making it infeasible to send a password reset email
  • Password managers are also infeasible, because we can't expect our medical staff to be setting up LastPass for the users (especially with no email address)
  • This is medical data, with all the regulation that comes with it.

Any suggestions for a password policy that secures our sensitive data without frustrating and driving away our entire user base?

*EDIT: Mobile app. There is a web app in the ecosystem in which medical staff reviews collected data, but it currently has no functionality for the patients.

ALSO EDIT: A lot of debate here between "you can assume they have smart phones" and "no you can't." It's a bit moot in our case because we provide $20 Androids to patients without one.

capnmojo
  • 761
  • 1
  • 4
  • 5
  • 4
    You said, *"... We have an app that helps them collect and submit ..."*. Why can't the APP setup also provide a unique Challenge-Response? – user10216038 Jan 19 '21 at 21:09
  • 7
    Can you clarify... when the medical staff sets the users password, is the user ever prompted to change it, or does the staff forever know what password they used? – mikem Jan 20 '21 at 06:46
  • 5
    Hand out hardware USB dongles? Go on the keyring. – Peter - Reinstate Monica Jan 20 '21 at 12:12
  • 11
    "*We have an app*" - does that mean a smartphone app? Web app? Arbitrary android-device app? Windows store app? Or something else? Providing more details about the used (hardware) platforms might elicit better answers. And how will the medical personal interact with your app? – Bergi Jan 20 '21 at 13:17
  • Have them bring their phone to the doctor's office to pair it. – user253751 Jan 20 '21 at 16:24
  • 4
    I use to push password complexity to all, but after lots of pentesting and password cracking in my career, I found that the issue wasn't about complexity, but one about implementation. I'm more concerned about the security of the login process and the password storage process. These are the processes that normally have flaws and are targets for cyber criminals or pentesters. – Life is complex Jan 20 '21 at 17:31
  • If you provide an Android phone to the user, why don't you also provide them a password management app to them too? Or why don't you implement a password system linked to the hardware of that device? – Life is complex Jan 20 '21 at 17:50
  • Clarifying question about your "ALSO EDIT": are you allowed to use the *the same device* for 2FA (SMS or push notification that your app automatically reads, do an Android intent to a TOTP app and auto-populate, etc), or does the authentication need to come from a source outside the phone? IE is physical possession of the phone device enough, or do you need to authenticate which human is using the device? I think a number of the answers below will end up using "access to the same device the app is on" as the second factor, which in fact is not a second factor at all. – Mike Ounsworth Jan 20 '21 at 19:55
  • Maybe you could use something like a YubiKey? – Max Jan 20 '21 at 20:15
  • @max Really a YubiKey for people over over 70? I had problems getting developers at a financial company to use their YubiKey and not lose them or leave them at home. Their average age was 26. – Life is complex Jan 20 '21 at 22:50
  • 2
    How in the world do you get a smartphone with an app on it, but no email address? – nvoigt Jan 21 '21 at 09:23
  • 1
    Is a $40 phone with a fingerprint sensor an option? You don't have to remember your fingerprint. – J... Jan 21 '21 at 11:07
  • Tell them to do a really long password like this dddddoooooggggg''''''sssssbbbbbooooonnnnneeeee111112222233333... easy to remember, impossible to crack with common tools? – bandybabboon Jan 22 '21 at 13:27
  • Why not just ask them for things they already know? Their birthday, place of birth, postcode, first child's name? If it works for password recovery security... – Caius Jard Jan 22 '21 at 16:48

12 Answers12

100

Disclosure: I work for the referenced company, and I'm not sure how to get the suggestion in this post across without it seeming like a sales pitch. Here goes.

It seems to me that "memorized passwords" and "our average user is over 70" are not going to play well together. Have you considered solutions other than passwords? You'd want something which is:

  • A physical object; ie non-memorized
  • Inexpensive for the doctor's office to hand out
  • Easy to use even for the (potentially severely) technologically-challenged.
  • Meets the security (and/or compliance) requirements for this product. Ex.: would you be allowed to use a physical object instead of a password? What if you coupled it with a weak password or knowledge-based set of questions.

You could consider having the doctor's office generate random passwords and print them out, but we all know that passwords of the form x7a8Cqr4dPt20 are not user-friendly.

The solution that comes to mind is Entrust Grid Cards (disclaimer: there may be other vendors who have similar features, but I'm not aware of any)

The doctor's office could print off a grid card on their standard office printer; when using the website / app the user will be challenged to provide three cells from the grid, if they lose the paper then they go back to the doctor's office and get a new one printed.

Entrust Grid Card

Mike Ounsworth
  • 58,107
  • 21
  • 154
  • 209
  • 30
    Effectively a poor-man's 2FA token. The only catch is that it isn't actually "2"FA because without a regular password there is no *first* factor. But a reasonable solution for all but the worst cases. The worst cases end up with a relative or trusted friend (or paid helper) setting up email for the elderly patient and dealing with passwords, etc. Which I am sure happens a **lot**. – manassehkatz-Moving 2 Codidact Jan 20 '21 at 04:31
  • 8
    An interesting solution. From https://www.entrust.com/-/media/documentation/datasheets/ds_idg-gridauthentication_web_mar2014.pdf : **Least-Used Cells Challenge** *This algorithm uses one or more least-used cells (set in policy) in every challenge. By generating challenges using the least-used cells from a user’s grid, it becomes more difficult for an attacker who has previously viewed some successful authentications to correctly respond to the challenge.* – brynk Jan 20 '21 at 08:27
  • 1
    I have a vague memory of a similar system that was created with the intention of replacing credit/debit card pin numbers, except in that system: You memorised positions, then the card reader would display a grid containing random(ish) integers and you enter the values at your secret positions. – DBS Jan 20 '21 at 09:48
  • 51
    Α sales-pitch-like answer is perfectly acceptable as soon as it is within the scope of the question, is not repetitive, and focus on how the product can address the issue in the question – usr-local-ΕΨΗΕΛΩΝ Jan 20 '21 at 09:58
  • 11
    I used a system exactly like this 8-10 years ago as a 2FA. It was annoying, but it worked well and was simple to use. I can imagine it working well for the 70+ set. – FreeMan Jan 20 '21 at 12:42
  • 3
    One of my local game companies produced a 2FA with the exact scheme back in 2008, targeting kids under 14. Turned out to be effective (physical printed cards, credit-card-sized) – iBug Jan 20 '21 at 14:35
  • 1
    There are open-source one-time-password solutions as well; the enduser gets a unique printed sheet of passwords or pass phrases, each indexed by a number, and on each login gets prompted for the next numbered one. As others have said, older folks are used to keeping documents "safe" and if they get help entering one, the helper doesn't get to know and remember a static password. – CCTO Jan 20 '21 at 14:50
  • 2
    @iBug Banks here print out those grids as well, and send them over mail. Each matrix-card (as we call them here) is tied to a single card, and has a 8x9 matrix with 3 digits each. You can see an example here: https://www.bancomontepio.pt/particulares/dia-a-dia/montepio24/cartao-matriz. These seem to be very effective, but banks seem to be slowly shifting towards SMS tokens. But well, if it works for 14 years olds or younger, I'm sure it works for older as well. It certainly works for me, and I'm nearly 30. – Ismael Miguel Jan 20 '21 at 15:16
  • Oh, that looks like something that would fit perfectly well into a smartphone case, then I have it at hand whenever I need it. – DonQuiKong Jan 20 '21 at 21:53
  • Why not use a TAN list? Much easier than the grid example which is quite challenging. – Michael Jan 21 '21 at 07:51
  • Another way to generate a password in a user friendly way is to create a passphrase using a word list such a is done in BIP-0039. Essentially there are 2048 distinct words and you randomly pick 12 of them to make the passphrase. As it's a mobile app you can encode the pass-phrase in a QR code and have the user scan the page https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki – UEFI Jan 21 '21 at 11:49
  • 3
    Ugh; seems like a client cert on a USB stick would do a better job. – Joshua Jan 21 '21 at 16:33
  • 1
    This reminds me of GRC's [Perfect Paper Passwords](https://www.grc.com/ppp). – Cyphase Jan 21 '21 at 22:43
  • 1
    Possible conflict of interest requires _disclosure_. A _disclaimer_ abdicates responsibility or liability. – eclipz905 Jan 22 '21 at 02:12
  • I remember banks used to send customers a "secret" plastic card with a grid of 3-digit codes and would ask you for a coordinate or two as a means of digital signature when transferring money or doing some other operations online or on the phone – fernandopcg Jan 22 '21 at 11:45
  • 2
    If using a primarily printed-card-based solution, PLEASE make sure to offer alternatives for users with bad eyesight — at least a large-print version, and ideally more, e.g. braille/audio options. – PLL Jan 22 '21 at 12:20
77

I know this doesn't entirely answer the question as asked, but another approach is to accept that, given your user community, a breach will happen sooner or later, and move instead to minimise the harm that then occurs.

You write that your app "helps them collect and submit physiological data to their doctors". Why, then, does the app have to enable them to read historical submitted data? If the app is instead write-only - fill in today's data, maybe go through a review screen to confirm all is as the user wishes, then press "submit" and the data is delivered to the surgery server and forgotten by the app - then compromise of the app doesn't compromise any stored medical data. You do still have the problem of someone maliciously submitting noise data, but you no longer have health records privacy issues.

Any suggestions for a ... policy that secures our sensitive data

Don't build an app that can get at it!

MadHatter
  • 1,027
  • 7
  • 10
  • 8
    This was my first thought as well. Treating the server as WOM from outside of the office’s internal network (and better yet actually enforcing that from systems external to both the server and the app) and not storing the data locally solves all the medical-record related problems (provided sufficient security is enforced on the actual connection to the server) and actually makes the app’s design much simpler. – Austin Hemmelgarn Jan 20 '21 at 17:45
  • Exactly. Stethoscopes, weighing scales, blood pressure monitors and FitBits are not required to be password-protected, and I suspect it's because they don't give historical access to the data they collect. – Dewi Morgan Jan 22 '21 at 20:17
33

Forget passwords.

Have them bring their phone to the doctor's office to pair it.

The (non-technical, but trained) medical professional verifies the patient's identity (which they should do already?), and links the phone app to the system using a QR code, a one-time password, or whatever mechanism you prefer.

Then, the phone saves those credentials and doesn't need them to be entered again.

The patient may choose to optionally put a password on the app to prevent their grandchildren from using it. But this is not required to protect the system from attackers without physical access.

Edit: If the patient is not comfortable handing their phone to the medical staff (probably the receptionist), you could have it so they show the patient a QR code that the patient has to scan. Considering your target audience, I suspect that many of them will be more comfortable with having the receptionist do it.

user253751
  • 4,610
  • 3
  • 21
  • 17
  • 1
    This was my thought as well, skip the password and have patients use a 2FA token app that scans their unique QR key and generates a new 6-digit code every 30 seconds. Nothing to print or protect, aside from "don't lose or share your phone". The downside would be the "password reset" process - they are forced to either return in person, or receive a QR code via another method (SMS, email, physical mail) which introduces its own security risks. – brichins Jan 21 '21 at 18:50
  • 5
    @brichins No! Forget the 2FA token app! Just put whatever system you use *inside the real app*! – user253751 Jan 21 '21 at 19:08
  • 4
    OK, I’ll bring my phone. Shold I bring the cord for the wall jack also? – Wirewrap Jan 22 '21 at 16:50
  • 2
    @Wirewrap You installed the health information app on your landline phone? Congrats, that's impressive. Yes, bring the cord, we'll plug it in at the office. – user253751 Jan 22 '21 at 17:39
  • @user253751 I installed the app on my iPad. My eyesight is not good enough for iphones, but iPad pro works for me. – Wirewrap Jan 22 '21 at 19:41
31

Suppose you've decided that "At least 8 characters, 1 symbol, 1 number, etc." is suitably random, but results in impossible-to-memorize passwords.

There are about 70^8 possible 8-letter passwords (assuming 52 letters, 10 digits, and 18 symbols). This offers 5.8e14 passwords.

A password generated randomly by concatenating 4 words from a list of 100,000 4-5 letter words will give you a 16-20 character password. This offers 1e20 possible passwords. This is enough of a buffer to allow staff to run the program 100s of times until they (or the client) see a password that they like.

Then just print out the password and hand it to the client.

The downside of this approach is that you end up with longer passwords.

Brian
  • 962
  • 5
  • 17
  • 1
    +1 To add to this, there are some great online "diceware" password generators; for example this one: https://diceware.dmuth.org/ – Mike Ounsworth Jan 19 '21 at 22:12
  • 34
    Also, older folks are used to protecting the security of physical documents like credit cards and check books. Tell them to protect the printed password in the same way as their checkbook and they'll fully understand. – FreeMan Jan 20 '21 at 12:44
  • Another way to generate a password in a user friendly way is to create a passphrase using a word list such a is done in BIP-0039. Essentially there are 2048 distinct words and you randomly pick 12 of them to make the passphrase. As it's a mobile app you can encode the pass-phrase in a QR code and have the user scan the page https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki – UEFI Jan 21 '21 at 11:50
9

FORGET COMPLEXITY - even the NIST has moved away from that. Length beats complexity.

For your seniors, neither is useable. They typically type slowly and their memory isn't the best anymore. Thinking they can remember YuVM5nUf%ui? correctly is delusional.

You need to think a bit sideways here. Check your threat model - what is the danger of someone with physical access? If that's not on your threat list, let them write the password down, and keep it in their wallet or something. That's not "best practice" but it's better than Dog123.

The best solution is probably to transition to passwordless login via a smartphone app. It's 2021, I think we can assume that even the seniors have a smartphone.

The slightly worse alternative is to move to 2FA with SMS auth codes. In this case, Dog123 is a perfectly good password because all it does is trigger an SMS. Typical auth codes are 4-6 digits, which is also good enough as it's a one-time password and even a probability of a correct guess of 0.1% (4 digits) is perfectly acceptable as we're not talking about nuclear launch codes.

Tom
  • 10,201
  • 19
  • 51
  • 16
    "I think we can assume that even the seniors have a smartphone" no, no we can't. My MIL does _not_ have one and she's in the OP's age group. Neither does my brother-in-law, and he's only 5 years older than me. They both flat refuse to get one (even though their spouses both have them). – FreeMan Jan 20 '21 at 12:47
  • 2
    The OP writes that his users have an app to collect medical data... – Tom Jan 20 '21 at 14:28
  • 9
    Believe it or not, "app" is short for "application" and "applications" can run on desktop/laptop computers or even in web browsers, in addition to running on smart phones. Us old guys generally call them "programs" when they run on a desktop computer, but all the cool (or, potentially, clueless) kids these days have taken to referring to _everything_ an "app". _Nothing_ in the original question indicates that this is a mobile only "app". – FreeMan Jan 20 '21 at 14:34
  • In that case, my final alternative will work. Let the OP pick whichever works for him. – Tom Jan 20 '21 at 15:21
  • 4
    @FreeMan OP has clarified that they provide smartphones on which the app runs for the users who do not have one. – Aubreal Jan 21 '21 at 16:46
  • Fair enough, @AlexandreAubrey, however that edit wasn't there yesterday when this was being discussed. That does now make my point moot on this particular question, but I still stand by my statement that you cannot simply assume that everyone has a smart phone as a general premise. – FreeMan Jan 21 '21 at 19:12
  • Mandatory XKCD: https://xkcd.com/936/ – Script Kid Jan 22 '21 at 14:22
6

What percentage of your clients carry smartphones? Do you think they would be able to use a "passwordless login" system with their phone? (i.e. FIDO)

All the FIDO systems use a one-time initial registration process, which consists of installing an app on the client's mobile device by scanning a QR code printed in an instructional brochure. That's the easy part, and your staff can help them do it in the office.

The tricky part is next: once the client is home at their computer, they have to navigate to your site, and click the "register" button. The client must then point their phone's camera at a registration QR code displayed on the computer's screen. It's a one-time process, and on-screen video instructions are supposed to help guide the user through registration, but it's not intuitive. On the plus side, once they know how to scan a QR code there's no Bluetooth pairing, NFC, WiFi logins, or other technical hurdles to overcome.

After the computer is registered, everyday operation is much easier. When they visit your website and click "Login", their phone pops up an alert that shows something like ( ) Decline ( ) Confirm. The client then taps the confirm button on their phone, and the web site logs them in.

They eliminate the need to remember passwords and are supposedly secure against attacks like phishing, but all the registration processes I've seen require an awkward step with a QR code.

John Deters
  • 33,897
  • 3
  • 58
  • 112
  • 2
    Unfortunately, my 80+ year old father, for example, has steadfastly refused to buy or use a 'smartphone'. "Too damned complicated". This is a man who designed and built homes, all his working life, from the ground up. Think about that (what it takes to design, build, and sell a home.) – CGCampbell Jan 20 '21 at 11:50
  • @CGCampbell, I'm finally getting my MIL to accept that it's time to abandon her old computer running Windows XP (yes, _XP_) in favor of the new laptop we got her running Win10. There's hope! – FreeMan Jan 20 '21 at 12:45
  • 2
    My Mum (94 now) is an enthusiastic user of Windows 10 and Google. My MIL (85), on the other hand, refuses to use any device more complicated than the TV remote. We gave her a special cellphone for grandmas, but she just doesn't use it. (She actually went to the doctor, was sent to hospital for tests, came back in the dark, fell on the steps and lay there all night, so getting pneumonia and being sent back to hospital and she still refuses to carry it about. No-one knew she'd even gone out.) – RedSonja Jan 20 '21 at 13:55
  • Clients could be given a choice between using a smartphone or a smartcard. But I'm not a huge fan of "punishing" people who hate smartphones by forcing them to carry around an electronic device. – Brian Jan 21 '21 at 15:48
  • 1
    Whatsapp Web uses a system like this - a QR code is shown on the PC screen which you have to scan with the app on your phone. Even though it walks you through the process, my Mum was completely baffled by the idea of scanning a QR code - it inevitably didn't work when she tried to hold the screen of the phone up against the computer screen where the QR code was shown... – Jonas Czech Jan 22 '21 at 13:33
3

The way this is usually done where I am is by asking the user to enter their name and date of birth, and then sending a 4-digit or 6-digit SMS verification code to the phone number associated with the account.

So the username and password are just their name and birthday (easy to remember), and the 2FA is the SMS code (and if they're using an app to view/submit scans etc then they probably have a phone).

You can't get much simpler than that, and it provides adequate security and minimal inconvenience, making it an ideal system for medical apps.

  • 5
    Be carefull of different laguages/systems of writing for names - how do you write a senior's name when he's 90 year old chinese man or 80 year old ukrainian grandma or if he's mongolian, arab or anyone with ambiguous way to write their western name. Hell, we've had problems with german names, as some people were used to writing their name with or without some special characters, or can't find them. I agree with date of birth, but names can be unexpectedly tricky as a method of authentication (not to mention that you;re inevitably gonna have six John Smiths born on 15. July 1948. – mishan Jan 20 '21 at 15:23
  • why not tether the app to the phone hardware and not send an SMS? Having the physical phone is than the second factor – Christian Jan 22 '21 at 20:23
1

Smartphone users, use a password manager. Others use a communal computer which prints 2 or 3 pieces of paper with a strong enough random generated password, 10-20 characters long.
Client stores paper in a secure location.
The client's trusted 2nd person stores paper in a secure location.
Management of elderly home store paper in a secure location.
I for Igloo, L for Lima, O for Oscar, and 0 for Zero are unambiguously written.
Symbols to have the pronunciation written below, as most people do not know.

Soufiane Tahiri
  • 2,667
  • 13
  • 27
user1416486
  • 11
  • 2
0

Here are the authentication steps you should take to minimize the memory burden. But be aware that any customer who is not capable of interacting with this model will need a human being on hand to interact manually with them. To fail to provide that human-to-human support is to fail your customers.

There is no magic. If they can't remember their passwords and have no phone for password recovery, then you are going to have to help them using other means... Like paying for someone to be on staff to talk to them. For those who are capable though:

  1. Make sure your app is compatible with all common biometric authentication systems, so the user can use fingerprint or facial recognition if available to them.
  2. Make sure your app works well with password managers, so the users can safely avoid remembering their passwords, and look them up for the few cases where it may be needed.
  3. Do not require ineffective and counterproductive password complexity. "MyPurpleShoes" is a far better password than "hW#*Qx33", and if the user has purple shoes they will be far more likely to remember it.
  4. Do not choose a user's password for them. Let them choose a memorable passphrase of their own.
  5. Offer text and email based password reset functionality, and make it easy.
  6. Do not force password changes or block the reuse of passwords during password reset.
  7. Offer text and email based two-factor authentication.
HumanJHawkins
  • 121
  • 7
0

For totally nontechnical users: Create a password form two components. First part is complex to thwart online hackers, one is very simple (like 4 digits) and has to be remembered.

You decide on the first part, and you write it down. The second part is remembered by the user. The first part should be easy to type on a phone, all lowercase for example, if you need a bit more security, make it longer.

So the password could be something like “anerkumse3527”, where you write the first part down on paper for them, and the number might be their house number and day of birth, or their credit card pin code. Hackers find it hard to crack because of its entropy, and an opportunist finding the card with no hacking experience can’t find the last four digits.

It’s not how I would protect state secrets, but it’s easy to use and may be good enough for your purposes.

gnasher729
  • 2,107
  • 11
  • 16
0

Given your user base, I think they should rely on having the passwords written in paper.

Note that when setting up the account at the doctor's, their initial password should not be generated by the technician. Just have the system generate an initial password for them. If you are generating the password, you can be sure it is properly random, even using normal words simpler to remember, and having the document appear with lots of screenshots, and the items properly substituted (if there is a field where they need to write "jdoe", put it there, not "username"):

Dear John Doe

Thanks for signing up with us. In order to submit a request you can do this:

1. Open your internet browser

(logo, browser imagee, etc)

2. Write https://capnmojocompany.com

(screen capture of your main page)

3. Click on "Submit request"

(mouse pointer on the zoomed button)


4. Enter the following data:

User: jdoe

Password: slobbery abroad plausible semester upstage

5. Press Enter

(new zoom on the button)

and so on explaining the needed steps

Yes, some will still have issues. Or not have internet access at all. I would recommend offering phone support for people when they get stuck. And to support in the user settings that they can put a designated person allowed to submit on their behalf (i.e. for the family member which will probably end up doing it for them)

I would recommend generating passphrases, I made the above sample password with xkcdpass, but the most important part is to have an adequate wordlist. You might want to ignore case (or accept passwords with inverted case)

You can then allow them to change the original password if they really want, but this setup seems reasonable. You should think how you want to handle the throttling. And what to do when they forget their password. Should they call you? Would you trust the doctors to be able to reset the password for any of your patients? Only of those they signed up themselves?

Also, I would preferably make the have doctors use a local application which sends directly to the printer the document with the credentials. If it's a pdf they can download, they might end up with the credentials of all their patients in their Downloads folder.

Ángel
  • 18,188
  • 3
  • 26
  • 63
0

Can I suggest implementing something like MFA? This will keep you secure whilst caring a little bit less about Dog123. Especially when the elderly will require something simple like that. Chances are they have written the password on paper anyway, so your best bet on maintaining a secure platform is to have MFA regardless.

Soufiane Tahiri
  • 2,667
  • 13
  • 27
brcstar
  • 1