Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

49% of workers, forced to change passwords, reuse same one with minor change

grahamcluley.com

Post reply on HN
Print view View original

111–120 of 316 posts

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#111

Post by kerng »

UncleMeat wrote: post #95
kerng wrote: post #73

Earlier quoted context omitted.

This is not true. If malware runs on your machine and there is no password manager storing 1400 passwords, the malware cannot pivot to 1400 destinations. However, if there is a password manager on the device that the malware gains access to and it would indeed store 1400 passwords in one place, then all 1400 assets are compromised at once. I think that's what the previous commenter wanted to highlight. In the end it'…

You'll presumably access those services eventually. And for the huge majority of people if they are memorizing a password for a infrequently used service means using a shitty password. "Even though the malware has access to my email, which I presumably login to with frequency, and therefore can perform password resets for many services, I might notice it and reformat my machine before I login to some other important…

The comment didnt talk about memorizing passwords, it's more about storing password manager files offline for very valuable assets.

It would not be smart to store crypto currency private keys or recovery pass words on main computer for instance.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#112

Post by fragmede »

peteretep wrote: post #103
fluidcruft wrote: post #102

Earlier quoted context omitted.

It would be really cool if you could plug your phone in and it appeared as a USB keyboard device and you could "type" the password from the password manager that way without ever giving the computer access to anything except that password. Maybe some sort of simple USB dongle (like a yubikey) could be fed by the phone via bluetooth or nfc to do this?

It would be even cooler if I could open an app on my phone, point it at a QR code on screen, and not have anything else bother me

Which, to be fair, is close to how it works inside Apple's walled garden. Logging into iCloud on a new computer will cause the iPhone attached to that account to pop-up a "confirm login" dialog, so the second factor for login is as unobtrusive as possible.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#113

Post by octorian »

petercooper wrote: post #36

There was an entertaining tale about this in Henry Marsh's Do No Harm: Stories of Life, Death and Brain Surgery (he's a very significant figure in brain surgery in the UK). There's a lot to it, but it came down to running around the hospital getting mad with the new digital system for looking at X-ray pictures rather than having them in physical format. Given one of the admin's passwords to try (it was something quit…

Somehow this reminds me of a problem my father (who is a doctor) has often complained about. Basically IT shitheads enforcing their policies on ALL computers in the hospital, including those used in operating rooms.

So that means things like a screen (displaying important information) locking from X minutes of inactivity, on a computer that the surgical team is physically unable to "bump" periodically or type a password on, due to them being scrubbed and sterile.

It reaches a point where you basically have to tell these people "Someone could DIE if you don't change the fucking policy for our use case" to get things to change.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#114

Post by octorian »

hwbehrens wrote: post #7

This should not be a surprise, as this supports the NIST's revised recommendations (from June 2017!) that passwords should not expire [0], because it actually leads to less-secure passwords for this exact reason. Furthermore, many corporate systems do not integrate well with password managers, such as when first logging in to your system in the morning. This means that the password is likely to be one of the few that…

> such as when first logging in to your system in the morning

This is what the article is talking about, but completely misses in its involved complaints. The best password manager in the world will NOT help you actually login to the computer you're running it on. So everyone at work basically has to have at least two passwords that need to be memorized: The main password to login to the machine, and the unlock password for the password manager.

Forcing these passwords to be impossible to remember is going to be a huge impediment, given how often you end up actually having to type them.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#115

Post by wcip »

peteretep wrote: post #103
fluidcruft wrote: post #102

Earlier quoted context omitted.

It would be really cool if you could plug your phone in and it appeared as a USB keyboard device and you could "type" the password from the password manager that way without ever giving the computer access to anything except that password. Maybe some sort of simple USB dongle (like a yubikey) could be fed by the phone via bluetooth or nfc to do this?

It would be even cooler if I could open an app on my phone, point it at a QR code on screen, and not have anything else bother me

Would you sue me if I tried to implement this? That is a amazing idea.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#117

Post by cgriswald »

tracker1 wrote: post #109

My single biggest issue is weird complexity requirements... let me simply use a relatively short sentence (15+ characters). If they limited requirement to length only + a breach check, that would be enough and encourage a sentence. "I really like sour grapes." is easy enough to remember and has plenty of complexity... of course, it gets much harder on a mobile device, this is where passphrase managers come into play…

Random words, yes. With random words, you've turned your set of 40 or so symbols into a set of 150K or so symbols, so it's fine that you've got fewer of them in your password.

I'm skeptical about actual sentences. With an actual sentence more common words will be chosen (so a smaller set of symbols), it will have a structure (no need for an attacker to try, for instance 'noun noun noun noun noun'), and people will probably choose from more common patterns: "I really hate arbitrary requirements."

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#119

Post by gruez »

Wowfunhappy wrote: post #35
zokier wrote: post #10

Earlier quoted context omitted.

Notebook is a password manager

...which stores passwords in unencrypted plain text. (Admittedly, the database is behind a very strong network firewall.)

even better: it's airgapped

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#120

Post by justincredible »

discreditable wrote: post #28
hwbehrens wrote: post #7

This should not be a surprise, as this supports the NIST's revised recommendations (from June 2017!) that passwords should not expire [0], because it actually leads to less-secure passwords for this exact reason. Furthermore, many corporate systems do not integrate well with password managers, such as when first logging in to your system in the morning. This means that the password is likely to be one of the few that…

My argument for password expiry (300 days here) is my users have complained they can't keep using the password they use everywhere else.

90 days here, 300 would be nice.
Post reply on HN