31–40 of 59 posts
Does anyone aside from HN type folks listen to these recommendations? I just had a major banking institution send me a plaintext pw instead of reset token, with a 15 char limit, and a rotation requirement.
Probably not. But if you work as a contractor for somebody with non-sensical requirements, at least you have some research that you can link to to support your point.
Some edict came through that scans had to be stored and accessed digitally. There were numerous teething problems in accessing the system, so a brain surgeon was going nuts running back and forth across the hospital trying to do his work.
A nurse in another department said he could use their consultant's login with the password 'fuckoff'. He ran back to his own desk, no go. So he went back and they said, "Ah, he has to keep changing the password each week so try fuckoff45" because the system had been set up almost a year prior. It didn't work, but after realizing more time had passed, he tried "fuckoff47" and it did the trick(!) Note that the problem here wasn't just the password but that sharing entire logins was/is rife.
(Update: I've found a reference to the story at https://www.theguardian.com/books/2014/mar/30/do-no-harm-sto...)
(The NHS is full of fun IT-related stories. Another was that due to patient privacy laws, keys to access scans had to be sent under separate transport. So you'd end up with situations where two couriers would be delivering separate USB sticks each to access a single scan.)
It's a double sword. The true issue with frequent password change is people really don't want to be creative. They ended up either changing one letter, or adding an extra letter. At least do a quick distance check and deny password at 90% similarity.
Oh, yeah. They'll never just write it down if you do that.
If nothing else, it means the person has to have physical access and be able to pass off rifling through someones desk after breaking it open.
While this sort of stuff has happened in on-premise pentests, it's certainly not the normal way to attack when it's done for real.
if similarity(old_password,new_password) > 50% then reject password change...
To prevent people doing this just throw in a string similarity algorithm into your password-change UI. if similarity(old_password,new_password) > 50% then reject password change...
To prevent people doing this just throw in a string similarity algorithm into your password-change UI. if similarity(old_password,new_password) > 50% then reject password change...
[1]: Or maybe "Foobar" (because you need a capital letter) or "Foobar!" (because you need a capital letter and a non-alphanumeric letter).
Does anyone actually have data showing that frequent password changes lead to better security? Because to me requiring frequent password change seems like the ultimate non-technical management blunder: management wants to say they did something to prevent hacks, so they ask IT to require password changes; IT doesn't want to be blamed so they implement it; users comply with the requirements but can't remember their ne…
To prevent people doing this just throw in a string similarity algorithm into your password-change UI. if similarity(old_password,new_password) > 50% then reject password change...
Seriously you cannot invent a password scheme where people can choose passwords that will not be vulnerable to this.