Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

49% of workers, forced to change passwords, reuse same one with minor change

grahamcluley.com

Post reply on HN
Print view View original

171–180 of 316 posts

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#171

Post by bashinator »

nickthegreek wrote: post #55
trianglem wrote: post #52

Earlier quoted context omitted.

I agree with all of this except password managers. If you use a lot of different public computers or temporary work laptops they don’t always let you install LastPass, so I frequently ended up being unable to access my accounts.

I access my manager from my phone and type them in. I would never install my LastPass on a public computer even if they let me.

It would be even cooler if there were no possible vector for the computer to then compromise your phone, but I don't really see that happening.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#172

Post by bashinator »

all_blue_chucks wrote: post #166
trianglem wrote: post #52

Earlier quoted context omitted.

I agree with all of this except password managers. If you use a lot of different public computers or temporary work laptops they don’t always let you install LastPass, so I frequently ended up being unable to access my accounts.

You should never, ever, ever type a password on a public computer.

Upvote. You have no way of knowing if that computer is compromised, say with bogus root SSL certificates to allow MitM of ostensibly secure web sites.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#173

Post by alain94040 »

fluidcruft wrote: post #102
nickthegreek wrote: post #55

Earlier quoted context omitted.

I access my manager from my phone and type them in. I would never install my LastPass on a public computer even if they let me.

It would be really cool if you could plug your phone in and it appeared as a USB keyboard device and you could "type" the password from the password manager that way without ever giving the computer access to anything except that password. Maybe some sort of simple USB dongle (like a yubikey) could be fed by the phone via bluetooth or nfc to do this?

That's exactly what KeoPass[1] does: a biometric key (your fingerprint), that behaves like a no-driver-needed USB dongle/keyboard.

Your grandpa could use it to secure his crypto wallet.

[1] https://www.keopass.com/index_en.html

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#174

Post by lostlogin »

nickthegreek wrote: post #55
trianglem wrote: post #52

Earlier quoted context omitted.

I agree with all of this except password managers. If you use a lot of different public computers or temporary work laptops they don’t always let you install LastPass, so I frequently ended up being unable to access my accounts.

I access my manager from my phone and type them in. I would never install my LastPass on a public computer even if they let me.

That gets old very fast too though. Copying a long and complicated password manually is pretty grim.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#175

Post by freehunter »

wcip wrote: post #115
peteretep wrote: post #103

Earlier quoted context omitted.

It would be even cooler if I could open an app on my phone, point it at a QR code on screen, and not have anything else bother me

Would you sue me if I tried to implement this? That is a amazing idea.

This has been done already, so no. There’s prior art. Look up Clef for one example.

https://en.m.wikipedia.org/wiki/Clef_(app)

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#176

Post by n4r9 »

trianglem wrote: post #52
orand wrote: post #32

Earlier quoted context omitted.

Bruce Schneier's summarization [0] of NIST's revised recommendations: 1. Stop it with the annoying password complexity rules. They make passwords harder to remember. They increase errors because artificially complex passwords are harder to type in. And they don't help that much. It's better to allow people to use pass phrases. 2. Stop it with password expiration. That was an old idea for an old way we used computers.…

I agree with all of this except password managers. If you use a lot of different public computers or temporary work laptops they don’t always let you install LastPass, so I frequently ended up being unable to access my accounts.

Use KeePass on a USB drive with a key file. You won't have to type a password or transmit anything over the internet.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#177

Post by peterburkimsher »

fluidcruft wrote: post #102
nickthegreek wrote: post #55

Earlier quoted context omitted.

I access my manager from my phone and type them in. I would never install my LastPass on a public computer even if they let me.

It would be really cool if you could plug your phone in and it appeared as a USB keyboard device and you could "type" the password from the password manager that way without ever giving the computer access to anything except that password. Maybe some sort of simple USB dongle (like a yubikey) could be fed by the phone via bluetooth or nfc to do this?

The EspUSB Tiny can pretend to be a USB keyboard and mouse, and it fits inside a USB socket. I've built prototypes already, and I've found a manufacturer for scaling up, but it's stalled since August because of certification issues.

It wouldn't be hard to add encrypted password storage to the EspUSB firmware. The difficulty is that you need to know the keyboard layout of the destination computer.

Keyboards don't send a letter "A", they send "shift" + "a". If your computer's language setting is French, or German, or Chinese, etc - things get complicated fast.

To make it worse, passwords need to use special characters (not just a-z). Sure, it's not unreasonable to ask you to change the keyboard layout, because you're on Hacker News and are therefore pretty good with computers. But this would limit an average user.

The other problem is that it types the password as plain text, which is a bit insecure. If I have to carry a dongle and change settings on the client, why not make the dongle do some sophisticated key pair exchange with the client app?

It's a good idea for another EspUSB demo app, but I worry that it couldn't find mass market adoption as a product. Without sales of over 10,000 devices, it's not possible to pay off the FCC certification lab, and I haven't got a solution for that.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#178

Post by harimau777 »

I'm still not entirely convinced that writing passwords down is such a horrible idea. An opponent who is willing to pickpocket me or break into my home to steal my password sheet is an opponent who will probably be able to social engineer their way in anyways.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#179

Post by freehunter »

_-david-_ wrote: post #149
discreditable wrote: post #28

Earlier quoted context omitted.

My argument for password expiry (300 days here) is my users have complained they can't keep using the password they use everywhere else.

They can change all their passwords every time one requires a change password.

Honestly that’s what I do at work. I have five passwords that all expire every 90 days and I made sure to get them expiring on the same date and in sync with the same password that matches the various policies and I just make minor iterations on that same theme every 90 days for all 5 passwords.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#180

Post by bashinator »

crankylinuxuser wrote: post #141
hwbehrens wrote: post #7

This should not be a surprise, as this supports the NIST's revised recommendations (from June 2017!) that passwords should not expire [0], because it actually leads to less-secure passwords for this exact reason. Furthermore, many corporate systems do not integrate well with password managers, such as when first logging in to your system in the morning. This means that the password is likely to be one of the few that…

So I was going to ask a variant on that question... How many businesses do you know follow NIST's new password guidelines?

Microsoft, for one.

https://practical365.com/security/microsoft-recommending-non...

Post reply on HN