61–70 of 316 posts
Earlier quoted context omitted.
yes but if you get keylogged while using a pw manager, you lose everything, as compared to losing one (or a few, depending on how egregious your passowrd reuse is)
If you have malware on your machine you already lose everything.
Wonder how many % use the password reset as an effective one-time password (unless cached) as they can't be arsed to remember the password complexity rules for every single site thwarting their simple password variations scheme.
Earlier quoted context omitted.
My argument for password expiry (300 days here) is my users have complained they can't keep using the password they use everywhere else.
They can they just have to wait. At my previous role I added a number and kept increasing until it accepted the orginal password and I started the cycle again.
A-Z, then AA-ZZ, AB-ZA and so on.
a) Passwords that are secure.
b) Passwords that can be remembered.
c) Passwords that must be rotated regularly.
You can pick two of the above, and it can be done. But you're not getting all three.
This should not be a surprise, as this supports the NIST's revised recommendations (from June 2017!) that passwords should not expire [0], because it actually leads to less-secure passwords for this exact reason. Furthermore, many corporate systems do not integrate well with password managers, such as when first logging in to your system in the morning. This means that the password is likely to be one of the few that…
...are there any desktop OS's which do integrate well with password managers, for your login password?
By definition, you can't open the password manager until you've logged into the machine. So you'd need to open the password manager on a separate device.
The one exception I can think of is if you're using the password manager built into the system, like Apple's keychain, in which case your login password is basically also your master password. Unfortunately, you then lose the ability to access your passwords on any other company's platform...
The thing I hate the most is random websites forcing you to use a password with "at least 8 characters, capital letters, numbers, .." I only care about my email account and a couple of other important websites. I want to be able to use the same simple password on other websites. So what if my account on pinterest or my local news website or some random forum is compromised... I don't care. I will either reset my pass…
Until recently my HN password was all zeroes. It was accepted. That's fine. I don't care too much if I lose my account.
I kid you not, those of us subject to rolling our passwords do just that. Add one. One system had a restriction of not the same password within 32 changes so inventive users were simply do that in one try until changes got limited to once per 24 hours
Earlier quoted context omitted.
If you have malware on your machine you already lose everything.
I guess the point is that the 1400-strong pw manager is the antithesis of defence in depth. If you get malware'd, better that they nab a few passwords than /all/ of the passwords.
However, I'm inclined to believe this is virtually impossible, for all but a handful of exceptionally talented individuals.
So if realistic options are (A) access all services via one password which is only stored in your password manager, or (B) access all services via one password, which is also given out to every single service, I think it's clear which is safer.
Earlier quoted context omitted.
Are you saying NIST and Schneier are wrong about this?
Schneier says "don't make people change their passwords unless there's indication of compromise" I make the assumption that the longer a password exists, the more likely it's reused and compromised. I don't have insight into every password dump, but I know my users reuse passwords a lot. I think a long expiry is the best balance in my environment.
If if you did a 1-year password expiration, and last year's passwords were compromised, then if the attacker figures out that someone's password last year was "uwethskjv9j29#18", then there's a good chance that the attacker is going to try logging in with the password "uwethskjv9j29#19" this year and "uwethskjv9j29#20" next year, and will probably succeed.
You gain nothing from password expiration, other than annoyed users and and even more annoyed IT team who has to deal with lockouts from people that changed their password to something secure.