Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

49% of workers, forced to change passwords, reuse same one with minor change

grahamcluley.com

Post reply on HN
Print view View original

31–40 of 316 posts

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#31

Post by Wowfunhappy »

discreditable wrote: post #28
hwbehrens wrote: post #7

This should not be a surprise, as this supports the NIST's revised recommendations (from June 2017!) that passwords should not expire [0], because it actually leads to less-secure passwords for this exact reason. Furthermore, many corporate systems do not integrate well with password managers, such as when first logging in to your system in the morning. This means that the password is likely to be one of the few that…

My argument for password expiry (300 days here) is my users have complained they can't keep using the password they use everywhere else.

And yet, you're also making it impractical for them to actually use a unique password, see what the GP said.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#32

Post by orand »

hwbehrens wrote: post #7

This should not be a surprise, as this supports the NIST's revised recommendations (from June 2017!) that passwords should not expire [0], because it actually leads to less-secure passwords for this exact reason. Furthermore, many corporate systems do not integrate well with password managers, such as when first logging in to your system in the morning. This means that the password is likely to be one of the few that…

Bruce Schneier's summarization [0] of NIST's revised recommendations:

1. Stop it with the annoying password complexity rules. They make passwords harder to remember. They increase errors because artificially complex passwords are harder to type in. And they don't help that much. It's better to allow people to use pass phrases.

2. Stop it with password expiration. That was an old idea for an old way we used computers. Today, don't make people change their passwords unless there's indication of compromise.

3. Let people use password managers. This is how we deal with all the passwords we need.

[0]: https://www.schneier.com/blog/archives/2017/10/changes_in_pa...

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#33

Post by dyingkneepad »

hwbehrens wrote: post #7

This should not be a surprise, as this supports the NIST's revised recommendations (from June 2017!) that passwords should not expire [0], because it actually leads to less-secure passwords for this exact reason. Furthermore, many corporate systems do not integrate well with password managers, such as when first logging in to your system in the morning. This means that the password is likely to be one of the few that…

I am forced to type 2 to 3 passwords every morning. The IT rules says I can't leave my laptop in my table overnight, so I have to every day type at least the disk encryption password + my login password. And sometimes I also have to type the VPN password. That's already 2 to 3 passwords every single time.

Not counting the SSH key passphrases for a lot of stuff...

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#34

Post by epitrochoidal »

pivo wrote: post #16
NedIsakoff wrote: post #9

The company I work for requires a password change every 60 days and a history of 9 passwords. Every other password I have in my 1Password so its ultra strong and secure (I use a 5 word passphrase). For my login password I just change the last digit in a loop between 0 and 9.

Pro tip: With a history of 9 passwords, change your password 10 times every time you change it until you loop back to the original. That way you can use the same password indefinitely.

I tried that one, but it doesn't work when there is another policy that says you are only allowed one password change per day.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#35

Post by Wowfunhappy »

zokier wrote: post #10
MFogleman wrote: post #4

50% write their passwords down in a notebook or sticky note near their computer[1] 1% use a password manager[1] [1]%100 of these stats are assumed

Notebook is a password manager

...which stores passwords in unencrypted plain text.

(Admittedly, the database is behind a very strong network firewall.)

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#36

Post by petercooper »

There was an entertaining tale about this in Henry Marsh's Do No Harm: Stories of Life, Death and Brain Surgery (he's a very significant figure in brain surgery in the UK).

There's a lot to it, but it came down to running around the hospital getting mad with the new digital system for looking at X-ray pictures rather than having them in physical format. Given one of the admin's passwords to try (it was something quite rude like "fuckoff"), he still couldn't make it work, and was advised that they were forced to change passwords every 30 days and to try "fuckoff2". It turned out the actual password was something like "fuckoff4" due to the time that had passed since the password had been shared around the department.

Edit: Found another recollection of the tale here: https://www.theguardian.com/books/2014/mar/30/do-no-harm-sto...

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#37

Post by wolco »

discreditable wrote: post #28
hwbehrens wrote: post #7

This should not be a surprise, as this supports the NIST's revised recommendations (from June 2017!) that passwords should not expire [0], because it actually leads to less-secure passwords for this exact reason. Furthermore, many corporate systems do not integrate well with password managers, such as when first logging in to your system in the morning. This means that the password is likely to be one of the few that…

My argument for password expiry (300 days here) is my users have complained they can't keep using the password they use everywhere else.

They can they just have to wait.

At my previous role I added a number and kept increasing until it accepted the orginal password and I started the cycle again.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#38

Post by stilisstuk »

My organisation has disabled built in password managers in both Firefox (semi understandable) and chrome and I assume edge. So there is that.

I can however install any Firefox extensions I chose. Enterprise architect is not security vetted. But archimate is.

Some of this is hard. A lot is theater.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#39

Post by blotter_paper »

ouid wrote: post #11
hwbehrens wrote: post #7

This should not be a surprise, as this supports the NIST's revised recommendations (from June 2017!) that passwords should not expire [0], because it actually leads to less-secure passwords for this exact reason. Furthermore, many corporate systems do not integrate well with password managers, such as when first logging in to your system in the morning. This means that the password is likely to be one of the few that…

please memorize: ZBkhTG1mchw7tr5bdKqknGGqFifuGDi7

If I had a good reason to memorize this, I would have it down within a couple weeks. I'm pretty certain of this, as I do have private keys committed to memory. That's not even impressive, folks who have good memory palace practices could recite that string for you a few minutes after seeing it. I wouldn't expect it of the average user, but it is totally doable for a human of average intelligence -- it's just not something people care about. For long term storage (rather than a repeatedly entered password) it's even easier if you convert[0] it to an equally random yet more humanly memorable line of text: "duck fade ink love reality possible shown screw thing win invisible realize child suffocate somehow petal army nervous"

[0]: https://brainwalletx.github.io/#converter

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#40

Post by discreditable »

Wowfunhappy wrote: post #31
discreditable wrote: post #28

Earlier quoted context omitted.

My argument for password expiry (300 days here) is my users have complained they can't keep using the password they use everywhere else.

And yet, you're also making it impractical for them to actually use a unique password, see what the GP said.

Nothing stops them from using a unique passphrase. I am subjected to the same password requirements and use a unique passphrase every time.

I see harvested passwords as a larger threat than bruteforcing, so some kind of expiry is important. Some users might use good, unique passwords, but most will not.

Post reply on HN