Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password expiration is dead, long live passwords

techcrunch.com

Post reply on HN
Print view View original

71–80 of 316 posts

Re: Password expiration is dead, long live passwords

#71

Post by alexeiz »

antoineMoPa wrote: post #30
dessant wrote: post #24

That's exciting news, though it will take a couple of years until it trickles down to financial institutions. My bank forces me to change passwords every 3 months, and of course they also disable pasting for added security. We also have a local utility that sends you a 5 letter password upon account creation through email, and that's your password. If you try to change it, they'll send you another 5 letter one.

Bank programmers live at least 5 years in the past.

Bank programmers don't live. They exist.

Re: Password expiration is dead, long live passwords

#72

Post by discreditable »

technion wrote: post #56
omh wrote: post #26

Earlier quoted context omitted.

How are you implementing these checks? I'm using Active Directory and options for extra password checks are somewhat limited.

Microsoft has a pwnedpasswords-like service you can use: https://docs.microsoft.com/en-us/azure/active-directory/auth...

* If you use Azure Active Directory

Re: Password expiration is dead, long live passwords

#73

Post by discreditable »

yaks_hairbrush wrote: post #47
jupp0r wrote: post #32

Earlier quoted context omitted.

Not sure about the legality of this, but trying to log in to a a couple of services would be an easy test.

A secure service wouldn't have an easy way of getting at a user's password. They'd store the salted hash of a user's password, and not the password itself.

If services were secure then password re-use would not be such a problem.

Re: Password expiration is dead, long live passwords

#74

Post by blarg1 »

arendtio wrote: post #69

Nice. So how many years will it take until someone realizes that asking users to include specific character classes actually decreases password security too? What I mean is that if you ask your users for a password that includes lower-case letters, upper-case letters, numbers and special characters you will probably end up with something like 'Password123!'. Instead, we could ask our users for reasonably complex pass…

for any password that requires capitals and numbers I always start it with the capital and end with the number to make it easier for me to remember.

Re: Password expiration is dead, long live passwords

#76

Post by extra88 »

noobermin wrote: post #58
scarejunba wrote: post #29

Earlier quoted context omitted.

The real problem? People introduce password expiration to improve security, but the means of producing a new unexpired password after being locked out is less secure than the password itself creating a net loss in security.

How did this idea of expiring passwords arise in the first place? Misguided intuition or did the infosec people back then just get it wrong?

I don't know the origin story but (U.S.) National Institute of Standards and Technology (NIST) recommending password expirations from 2003 until 2016 played a part in propagating them. But I think that recommendation was largely based on was already fairly common, I think Microsoft Windows and Active Directory accounts expired by default well before 2003 (at least Windows NT and its successors).

Re: Password expiration is dead, long live passwords

#78

Post by drilldrive »

blarg1 wrote: post #74
arendtio wrote: post #69

Nice. So how many years will it take until someone realizes that asking users to include specific character classes actually decreases password security too? What I mean is that if you ask your users for a password that includes lower-case letters, upper-case letters, numbers and special characters you will probably end up with something like 'Password123!'. Instead, we could ask our users for reasonably complex pass…

for any password that requires capitals and numbers I always start it with the capital and end with the number to make it easier for me to remember.

And I am sure at least 95% of the populace does the same, and that such passwords are usually quite short. We need a better solution for passwords than we do now.

Re: Password expiration is dead, long live passwords

#79

Post by jsonau »

Another worst offender are security questions to unlock accounts. Answers to these questions are usually visible to customer service reps and similar set of questions are asked among different services. This is scary.

It's dangerous as having password stored in plain text as answers to the security questions can potentially unlock many other accounts.

I highly suggest everyone answers each of them with a unique answer.

Re: Password expiration is dead, long live passwords

#80

Post by air7 »

jeremyjh wrote: post #17
discreditable wrote: post #12

I still expire passwords on a yearly basis for the sole reason that users have complained to me that it stops them from using the password they use for everything else.

I came here to say this. I can't think of another way to guarantee that they aren't using the same password that they use on every website they've visited since 1997. If anyone has suggestions on this I'd love to hear it.

I disagree. I feel it's not a site's responsibility to stop users from reusing their passwords if they choose to. It has no relation to the security of the service. As a metaphor, a good lock maker protects their customers from lock picking, not from a key left under the mat.

Personally, I reuse a simple password for very non-important services and it's very convenient. I think that's ok, or at the very least I should be able to choose to.

Post reply on HN