Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

49% of workers, forced to change passwords, reuse same one with minor change

grahamcluley.com

Post reply on HN
Print view View original

51–60 of 316 posts

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#51

Post by jerf »

ouid wrote: post #11
hwbehrens wrote: post #7

This should not be a surprise, as this supports the NIST's revised recommendations (from June 2017!) that passwords should not expire [0], because it actually leads to less-secure passwords for this exact reason. Furthermore, many corporate systems do not integrate well with password managers, such as when first logging in to your system in the morning. This means that the password is likely to be one of the few that…

please memorize: ZBkhTG1mchw7tr5bdKqknGGqFifuGDi7

Zaphod Beeblebrox's kite harasses Tuscon. Great, one more collapsing home. Why? 7 termites risk 5 bad days. Knight's queen kills narcs; Good Game queen. Fighting inside futons upends Greater Detroit in 7.

But that's because you forced the choice on me, and I'm only willing to work so hard for a Hacker News post. Ideally, you turn it into one coherent story. If I can choose my password, and I usually can after all:

Zaphod Beeblebrox wears 3 hats. He gives 1 to Ford. Why did he do that? He only has 2 heads. Xavier can't read Zaphod's mind now. (Does he even want to?)

ZBw3hHg1tFWdhdt?Hoh2hXcrZmn(Dhewt?)

That's 35. I could have that mostly memorized in a day's relatively normal usage, and definitely have it by a week. I have some rules I apply, like numbers -> their digits, periods are "free" but the other punctuation goes in, etc. Doesn't much matter what your rules are, as long as you're consistent.

Technically, this is less random that a truly random password, because rather than drawing uniformly from the space of possible symbols, you're tilted in the direction of what words can start with and some other things like that. I tend to just make up for that by swinging more entropy at the problem, and trying to work in some Xs and Zs and unusual symbols, and figure that it gets me close enough.

One trick to this: If you find in the first day that you're consistently remembering the phrase differently than you first laid it out, just take the hint and change the password.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#52

Post by trianglem »

orand wrote: post #32
hwbehrens wrote: post #7

This should not be a surprise, as this supports the NIST's revised recommendations (from June 2017!) that passwords should not expire [0], because it actually leads to less-secure passwords for this exact reason. Furthermore, many corporate systems do not integrate well with password managers, such as when first logging in to your system in the morning. This means that the password is likely to be one of the few that…

Bruce Schneier's summarization [0] of NIST's revised recommendations: 1. Stop it with the annoying password complexity rules. They make passwords harder to remember. They increase errors because artificially complex passwords are harder to type in. And they don't help that much. It's better to allow people to use pass phrases. 2. Stop it with password expiration. That was an old idea for an old way we used computers.…

I agree with all of this except password managers. If you use a lot of different public computers or temporary work laptops they don’t always let you install LastPass, so I frequently ended up being unable to access my accounts.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#53

Post by lostmsu »

hwbehrens wrote: post #7

This should not be a surprise, as this supports the NIST's revised recommendations (from June 2017!) that passwords should not expire [0], because it actually leads to less-secure passwords for this exact reason. Furthermore, many corporate systems do not integrate well with password managers, such as when first logging in to your system in the morning. This means that the password is likely to be one of the few that…

I wish they would read that recommendation at sbir.gov

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#54

Post by kardos »

kevinsundar wrote: post #14
kardos wrote: post #12

> I have over 1400 passwords, stored securely in a password manager. Is the password manager not a single point of failure in this model?

Yes but you can protect your password manager with one incredibly secure password. For example, 20 characters.

yes but if you get keylogged while using a pw manager, you lose everything, as compared to losing one (or a few, depending on how egregious your passowrd reuse is)

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#55

Post by nickthegreek »

trianglem wrote: post #52
orand wrote: post #32

Earlier quoted context omitted.

Bruce Schneier's summarization [0] of NIST's revised recommendations: 1. Stop it with the annoying password complexity rules. They make passwords harder to remember. They increase errors because artificially complex passwords are harder to type in. And they don't help that much. It's better to allow people to use pass phrases. 2. Stop it with password expiration. That was an old idea for an old way we used computers.…

I agree with all of this except password managers. If you use a lot of different public computers or temporary work laptops they don’t always let you install LastPass, so I frequently ended up being unable to access my accounts.

I access my manager from my phone and type them in. I would never install my LastPass on a public computer even if they let me.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#56

Post by nickthegreek »

kardos wrote: post #54
kevinsundar wrote: post #14

Earlier quoted context omitted.

Yes but you can protect your password manager with one incredibly secure password. For example, 20 characters.

yes but if you get keylogged while using a pw manager, you lose everything, as compared to losing one (or a few, depending on how egregious your passowrd reuse is)

You can also 2FA your manager, minimizing that attack vector.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#57

Post by jaclaz »

nkrisc wrote: post #8

Companies should provide a password manager solution for their employees, if they care. They make us change it every 30-90 days, tell us not to write it down anywhere, and don't want us to just add '1' on the end, but expect us to memorize it. I'm not going to pony up my own money for a password manager to use at work and try to make it work there. I pay for one for my own use and it stays for personal use.

Just in case, not exactly a password manager, but good enough for using as one, and completely free (windows):

Readme.txt:

http://www.dcmembers.com/f0dder/wp-content/uploads/sites/18/...

Homepage/Download:

http://www.dcmembers.com/f0dder/download/fsekrit/

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#58

Post by toomuchtodo »

trianglem wrote: post #52
orand wrote: post #32

Earlier quoted context omitted.

Bruce Schneier's summarization [0] of NIST's revised recommendations: 1. Stop it with the annoying password complexity rules. They make passwords harder to remember. They increase errors because artificially complex passwords are harder to type in. And they don't help that much. It's better to allow people to use pass phrases. 2. Stop it with password expiration. That was an old idea for an old way we used computers.…

I agree with all of this except password managers. If you use a lot of different public computers or temporary work laptops they don’t always let you install LastPass, so I frequently ended up being unable to access my accounts.

For scenarios like this, where the hardware is untrusted, Yubikey type devices are really the only solution (where the device can present as a user input device, and provide the necessary string secret). Everyone else can use a password manager.

EDIT: If you're on an untrusted device, should you really be putting secrets into it? Maybe not!

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#59

Post by UncleMeat »

kardos wrote: post #54
kevinsundar wrote: post #14

Earlier quoted context omitted.

Yes but you can protect your password manager with one incredibly secure password. For example, 20 characters.

yes but if you get keylogged while using a pw manager, you lose everything, as compared to losing one (or a few, depending on how egregious your passowrd reuse is)

If you have malware on your machine you already lose everything.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#60

Post by stevenicr »

I used to set many passwords with slight variations.

One day I turned on failed login pass capture on a couple of wordpress web sites. I did see some of what I expected, they tried many of the most common passwords,

what surprised me is that they also attempted all kinds of similar variations that included words that our sites might use, but were not in the most common used pass dictionaries.

So they were not just using dictionary and common pass attacks, they were also attempting ones and slight variations of ones that may or may not have included that common things, plus site specific things, then with slight variations.

That was kind of spooky, and had me change up how I set up some things for other people.

Post reply on HN