Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

49% of workers, forced to change passwords, reuse same one with minor change

grahamcluley.com

Post reply on HN
Print view View original

161–170 of 316 posts

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#161

Post by paxy »

trianglem wrote: post #52
orand wrote: post #32

Earlier quoted context omitted.

Bruce Schneier's summarization [0] of NIST's revised recommendations: 1. Stop it with the annoying password complexity rules. They make passwords harder to remember. They increase errors because artificially complex passwords are harder to type in. And they don't help that much. It's better to allow people to use pass phrases. 2. Stop it with password expiration. That was an old idea for an old way we used computers.…

I agree with all of this except password managers. If you use a lot of different public computers or temporary work laptops they don’t always let you install LastPass, so I frequently ended up being unable to access my accounts.

That's an even bigger reason to use password managers. Use a mobile app and 2FA.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#162

Post by interactivecode »

peteretep wrote: post #103
fluidcruft wrote: post #102

Earlier quoted context omitted.

It would be really cool if you could plug your phone in and it appeared as a USB keyboard device and you could "type" the password from the password manager that way without ever giving the computer access to anything except that password. Maybe some sort of simple USB dongle (like a yubikey) could be fed by the phone via bluetooth or nfc to do this?

It would be even cooler if I could open an app on my phone, point it at a QR code on screen, and not have anything else bother me

I know of a couple banking apps that use this. super handy!

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#163

Post by ineedasername »

The surprising thing is that is's only 49%. I kind of think that at least another 40% are lying, and another 10% only think their new password is substantially different ("I used uppercase instead and I incremented my trailing counter from 10 to 11!")

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#164

Post by ZainRiz »

hwbehrens wrote: post #7

This should not be a surprise, as this supports the NIST's revised recommendations (from June 2017!) that passwords should not expire [0], because it actually leads to less-secure passwords for this exact reason. Furthermore, many corporate systems do not integrate well with password managers, such as when first logging in to your system in the morning. This means that the password is likely to be one of the few that…

Frankly, the most surprising thing about this article is that only 49% of people do this.

Do the other 51% sincerely try to change their passwords? Or maybe they were too scared to report the truth :P

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#165

Post by scarejunba »

Tagbert wrote: post #66
scarejunba wrote: post #49

Earlier quoted context omitted.

Until recently my HN password was all zeroes. It was accepted. That's fine. I don't care too much if I lose my account.

Ah, that explains some of the odd posts from you I’ve seen recently. Must be the “other guy” :)

Easy way out from complaints, eh? :D

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#166

Post by all_blue_chucks »

trianglem wrote: post #52
orand wrote: post #32

Earlier quoted context omitted.

Bruce Schneier's summarization [0] of NIST's revised recommendations: 1. Stop it with the annoying password complexity rules. They make passwords harder to remember. They increase errors because artificially complex passwords are harder to type in. And they don't help that much. It's better to allow people to use pass phrases. 2. Stop it with password expiration. That was an old idea for an old way we used computers.…

I agree with all of this except password managers. If you use a lot of different public computers or temporary work laptops they don’t always let you install LastPass, so I frequently ended up being unable to access my accounts.

You should never, ever, ever type a password on a public computer.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#167

Post by spookthesunset »

all_blue_chucks wrote: post #166
trianglem wrote: post #52

Earlier quoted context omitted.

I agree with all of this except password managers. If you use a lot of different public computers or temporary work laptops they don’t always let you install LastPass, so I frequently ended up being unable to access my accounts.

You should never, ever, ever type a password on a public computer.

So basically, you should never use public computers for anything beyond looking at YouTube anonymously?

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#168

Post by kazinator »

hwbehrens wrote: post #7

This should not be a surprise, as this supports the NIST's revised recommendations (from June 2017!) that passwords should not expire [0], because it actually leads to less-secure passwords for this exact reason. Furthermore, many corporate systems do not integrate well with password managers, such as when first logging in to your system in the morning. This means that the password is likely to be one of the few that…

If you ask me to memorize a 32-character random string every 6 months, I will memorize a 31-character string, plus one incrementing character.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#169

Post by freeAgent »

I would be shocked if it was actually that low. Doesn't everyone who's forced to change passwords every few months simply increment a number or change a single character?

I'm not afraid or ashamed to admit that this is what I do. However, with that being said, I never reuse passwords. If my password on any given service (including work) actually did get hacked, I would change it to something dramatically different and that would be that.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#170

Post by ben509 »

peteretep wrote: post #103
fluidcruft wrote: post #102

Earlier quoted context omitted.

It would be really cool if you could plug your phone in and it appeared as a USB keyboard device and you could "type" the password from the password manager that way without ever giving the computer access to anything except that password. Maybe some sort of simple USB dongle (like a yubikey) could be fed by the phone via bluetooth or nfc to do this?

It would be even cooler if I could open an app on my phone, point it at a QR code on screen, and not have anything else bother me

All the QR code needs to encode is a URL pointing to their authentication endpoint. If it's reasonably standardized, any password manager could implement it.

Login would be:

* scan QR code, sees https:/ /megacorp.com/login?session=hexhexhex

* Password manager asks that you want to log in with account X.

* Negotiates with auth service

* Website recieves your confirmed token via websocket

* You're logged in.

And, of course, if you don't have an account, the password manager can get you started creating one.

Post reply on HN