Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

49% of workers, forced to change passwords, reuse same one with minor change

grahamcluley.com

Post reply on HN
Print view View original

121–130 of 316 posts

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#121

Post by mewse »

Sohcahtoa82 wrote: post #74
MrMember wrote: post #13

The password requirements at my job are, in my opinion, insane. It has to be a specified length (an exact number of characters, no more, no less), can't contain any 3+ character words found in a dictionary, and a few other requirements like at least one capital letter and at least one number. And it has to change every three months. So yes, when I have to change my password I end up changing a single character or dig…

I've heard of banks setting a 8-character limit on password length. If my bank did that, I'd be searching for a new bank. Just just reeks of passwords being stored in plain text.

I used to use a major local bank which had (and still has) a 6 character limit on password length. For real. Also, no symbols allowed.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#122

Post by thiagomgd »

nickthegreek wrote: post #56
kardos wrote: post #54

Earlier quoted context omitted.

yes but if you get keylogged while using a pw manager, you lose everything, as compared to losing one (or a few, depending on how egregious your passowrd reuse is)

You can also 2FA your manager, minimizing that attack vector.

Which is what my company does with lastPass. (Although on my personal manager I don't use it)

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#123

Post by obelos »

I used to have to deal with an enterprise system that required quarterly password changes. The interesting thing about this system was it would refuse to let you set a new password that wasn't sufficiently different from the previous several passwords... Which almost certainly means they were implementing this security measure by storing the passwords in plaintext on the server.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#124

Post by swiley »

Shared secrets are a really dumb way to handle authentication.

Set up a CA and sign the public keys for machines you provision to employees. All the tools are there, most software supports it (not the iPhone of course, although I’m sure there’s a hackish workaround that involves periodically sending apple money to sign something.)

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#126

Post by tartoran »

dyingkneepad wrote: post #33
hwbehrens wrote: post #7

This should not be a surprise, as this supports the NIST's revised recommendations (from June 2017!) that passwords should not expire [0], because it actually leads to less-secure passwords for this exact reason. Furthermore, many corporate systems do not integrate well with password managers, such as when first logging in to your system in the morning. This means that the password is likely to be one of the few that…

I am forced to type 2 to 3 passwords every morning. The IT rules says I can't leave my laptop in my table overnight, so I have to every day type at least the disk encryption password + my login password. And sometimes I also have to type the VPN password. That's already 2 to 3 passwords every single time . Not counting the SSH key passphrases for a lot of stuff...

Are complicated passwords take you a long time to write? Based on this calculation here's how long we waste on meaningless tasks every year:

     minutes   minutes/month  minutes/year(hours/year)
     1         ~22           ~266(~4.4h)
     2         ~44           ~530(~8.8h)
     3         ~66           ~792(~13h)
*this only takes into account business work days. If you add weekends the number goes up...

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#127

Post by downerending »

dyingkneepad wrote: post #33
hwbehrens wrote: post #7

This should not be a surprise, as this supports the NIST's revised recommendations (from June 2017!) that passwords should not expire [0], because it actually leads to less-secure passwords for this exact reason. Furthermore, many corporate systems do not integrate well with password managers, such as when first logging in to your system in the morning. This means that the password is likely to be one of the few that…

I am forced to type 2 to 3 passwords every morning. The IT rules says I can't leave my laptop in my table overnight, so I have to every day type at least the disk encryption password + my login password. And sometimes I also have to type the VPN password. That's already 2 to 3 passwords every single time . Not counting the SSH key passphrases for a lot of stuff...

I've worked for two trading firms. One required six passwords to reach "root" access, when coming in remotely (e.g., from home).

The other used the name of the company as the root password for all hosts, accessible from anywhere within the offices.

Horses for courses, I guess.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#128

Post by xur17 »

orthros wrote: post #105

My work required me to change passwords every 90 days. I worked there for 8 years. My first password was [password]1 and my last one was [password]34. I'm guessing this isn't what they had in mind.

My first job out of college had a policy like this, and I did something similar. Biggest problem was that we had multiple password systems, all with their own policies, so my passwords slowly got out of sync.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#129

Post by nwallin »

Insanity wrote: post #82
jerf wrote: post #51

Earlier quoted context omitted.

Zaphod Beeblebrox's kite harasses Tuscon. Great, one more collapsing home. Why? 7 termites risk 5 bad days. Knight's queen kills narcs; Good Game queen. Fighting inside futons upends Greater Detroit in 7. But that's because you forced the choice on me, and I'm only willing to work so hard for a Hacker News post. Ideally, you turn it into one coherent story. If I can choose my password, and I usually can after all: Za…

How fast can you enter that password? Like, is it a reasonable time or are you basically pecking at your keys?

I do passwords this way. At first, it's pretty slow, but after a while it's muscle memory: my fingers know my passwords better than my brain does.

I don't do passwords this way at work anymore, because they make us change it every 90 days. I just use keyboard patterns, and shift the pattern to the right for each successive password. Seriously people, expiring passwords is an idiotic idea.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#130

Post by Sylamore »

wolco wrote: post #37
discreditable wrote: post #28

Earlier quoted context omitted.

My argument for password expiry (300 days here) is my users have complained they can't keep using the password they use everywhere else.

They can they just have to wait. At my previous role I added a number and kept increasing until it accepted the orginal password and I started the cycle again.

Because of minimum age rules, I just spell out the number if I can't recycle the old password yet.

One of the reasons I don't do IT security any more is the attachment to old dogma like these kinds of password rules by auditors - they are the real barrier to making policies more effective.

Post reply on HN