NIST’s new password rules – what you need to know • Hacker News Board

Re: NIST’s new password rules – what you need to know

#11

Post by sp332 » Tue, Nov 22, 2016, 10:52 PM UTC

sib wrote: post #9

adrr wrote: post #4

Earlier quoted context omitted.

PCI compliance requires quarterly rotation of passwords and keys.

Nothing better than rules based on bad data and security theater.

If your password is compromised, it will only work until the next reset. That's better than having one that works for years.

Re: NIST’s new password rules – what you need to know

#12

Post by rdiddly » Tue, Nov 22, 2016, 10:55 PM UTC

I'm no security expert, but I'm pleased to see several things being forbidden that in the back of my mind, I always thought were a little fishy.

Re: NIST’s new password rules – what you need to know

#13

Post by rdiddly » Tue, Nov 22, 2016, 10:57 PM UTC

mylesm wrote: post #7

Looks like some good suggestions: - Glad they're recommending a stop to the pointless "password must be no longer than (16, 20, ...) characters". Aren't you storing a constant-length hash anyway? - Why do some logins restrict which ASCII characters can be used? When I see that I can use any symbol from '%!#&' or whatever list they provide, I can only imagine it's a really naive SQL-injection defense. Is there any val…

I just use the security questions as another password, like my favorite color is JyQ|l[Duc-I6KrU-0k and I went to elementary school at ?YfBW+Yurh@m$lml":.

Re: NIST’s new password rules – what you need to know

#14

Post by undersuit » Tue, Nov 22, 2016, 10:59 PM UTC

lucaspiller wrote: post #3

Recommending not expiring based on time is probably my favourite. I've worked at two places where that's been a requirement and my password has always been a passphrase combined with a sequencial number.

We have a script that updates our passwords for some automated processes. So let's just increment a number inside the password every month with some perl!

  /^(.*?)(\d+)(.*?)$/

Re: NIST’s new password rules – what you need to know

#15

Post by zwily » Tue, Nov 22, 2016, 11:00 PM UTC

rdiddly wrote: post #13

mylesm wrote: post #7

Looks like some good suggestions: - Glad they're recommending a stop to the pointless "password must be no longer than (16, 20, ...) characters". Aren't you storing a constant-length hash anyway? - Why do some logins restrict which ASCII characters can be used? When I see that I can use any symbol from '%!#&' or whatever list they provide, I can only imagine it's a really naive SQL-injection defense. Is there any val…

I just use the security questions as another password, like my favorite color is JyQ|l[Duc-I6KrU-0k and I went to elementary school at ?YfBW+Yurh@m$lml":.

Those are rough when a customer service rep asks you for one of those over the phone... :)

Re: NIST’s new password rules – what you need to know

#16

Post by Nadya » Tue, Nov 22, 2016, 11:03 PM UTC

zwily wrote: post #15

rdiddly wrote: post #13

Earlier quoted context omitted.

I just use the security questions as another password, like my favorite color is JyQ|l[Duc-I6KrU-0k and I went to elementary school at ?YfBW+Yurh@m$lml":.

Those are rough when a customer service rep asks you for one of those over the phone... :)

I was literally just about to post this. I refuse to make my password less secure though - and security questions really are just "alternate passwords".

I've never had a problem but I have had a few reps who are trying to not act really surprised. I've had one instance of someone trying to stifle laughter (of the "You can't be serious") kind. Taking security seriously is a rare thing. :(

They usually stop me after the 8th or so character. I'd be concerned but if any potential social engineer has the first 8 characters they likely have the full string anyways so stopping early makes both our jobs easier.

Re: NIST’s new password rules – what you need to know

#17

Post by [deleted] » Tue, Nov 22, 2016, 11:03 PM UTC

[deleted]

Re: NIST’s new password rules – what you need to know

#18

Post by nitrogen » Tue, Nov 22, 2016, 11:06 PM UTC

sp332 wrote: post #11

sib wrote: post #9

Earlier quoted context omitted.

Nothing better than rules based on bad data and security theater.

If your password is compromised, it will only work until the next reset. That's better than having one that works for years.

If your password is compromised, you've already lost. Since password rotation policies incentivize weak passwords, they are more likely to result in a compromised password. Thus, password rotation with weak passwords is not better than a single strong password that is never rotated.

Re: NIST’s new password rules – what you need to know

#19

Post by ryanlol » Tue, Nov 22, 2016, 11:08 PM UTC

zwily wrote: post #15

rdiddly wrote: post #13

Earlier quoted context omitted.

I just use the security questions as another password, like my favorite color is JyQ|l[Duc-I6KrU-0k and I went to elementary school at ?YfBW+Yurh@m$lml":.

Those are rough when a customer service rep asks you for one of those over the phone... :)

On several social engineering calls I've had reps who were happy with just "it's just a bunch of random characters, would be a little silly if I tried to read it out"

Re: NIST’s new password rules – what you need to know

#20

Post by josephg » Tue, Nov 22, 2016, 11:09 PM UTC

zwily wrote: post #15

rdiddly wrote: post #13

Earlier quoted context omitted.

I just use the security questions as another password, like my favorite color is JyQ|l[Duc-I6KrU-0k and I went to elementary school at ?YfBW+Yurh@m$lml":.

Those are rough when a customer service rep asks you for one of those over the phone... :)

I do this. I told the CS rep that my password hint was "just random characters mashed on the keyboard" and she accepted this and moved on. I'm not sure what to think of the security implications.