Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

49% of workers, forced to change passwords, reuse same one with minor change

grahamcluley.com

Post reply on HN
Print view View original

181–190 of 316 posts

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#181

Post by notlukesky »

ben509 wrote: post #170
peteretep wrote: post #103

Earlier quoted context omitted.

It would be even cooler if I could open an app on my phone, point it at a QR code on screen, and not have anything else bother me

All the QR code needs to encode is a URL pointing to their authentication endpoint. If it's reasonably standardized, any password manager could implement it. Login would be: * scan QR code, sees https:/ /megacorp.com/login?session=hexhexhex * Password manager asks that you want to log in with account X. * Negotiates with auth service * Website recieves your confirmed token via websocket * You're logged in. And, of co…

SAASPASS does this as well.

https://saaspass.com/

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#182

Post by tomp »

fragmede wrote: post #112
peteretep wrote: post #103

Earlier quoted context omitted.

It would be even cooler if I could open an app on my phone, point it at a QR code on screen, and not have anything else bother me

Which, to be fair, is close to how it works inside Apple's walled garden. Logging into iCloud on a new computer will cause the iPhone attached to that account to pop-up a "confirm login" dialog, so the second factor for login is as unobtrusive as possible.

No you still need a password, which also makes it insecure on a public computer (where keyloggers might be installed).

Instead, the better solution would be, you point your phone to a QR code on the computer screen, press “confirm”, the computer is magically logged in, until you then press “log out” on your phone and the computer is logged out.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#183

Post by KC8ZKF »

JackRabbitSlim wrote: post #107
Sohcahtoa82 wrote: post #74

Earlier quoted context omitted.

I've heard of banks setting a 8-character limit on password length. If my bank did that, I'd be searching for a new bank. Just just reeks of passwords being stored in plain text.

IBM legacy in action. Nobody ever got fired for buying IBM, but some of them probably should have been.

IBM? AT&T, more likely. Unix had an 8 character limit long after people knew better.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#184

Post by mint2 »

orand wrote: post #32
hwbehrens wrote: post #7

This should not be a surprise, as this supports the NIST's revised recommendations (from June 2017!) that passwords should not expire [0], because it actually leads to less-secure passwords for this exact reason. Furthermore, many corporate systems do not integrate well with password managers, such as when first logging in to your system in the morning. This means that the password is likely to be one of the few that…

Bruce Schneier's summarization [0] of NIST's revised recommendations: 1. Stop it with the annoying password complexity rules. They make passwords harder to remember. They increase errors because artificially complex passwords are harder to type in. And they don't help that much. It's better to allow people to use pass phrases. 2. Stop it with password expiration. That was an old idea for an old way we used computers.…

Unfortunately my company claims their credit card and electronic payment processing agreements require employee password to expire.

If that’s actually true, then most companies hands are tied until those payment agencies update their requirements.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#185

Post by sitharus »

mint2 wrote: post #184
orand wrote: post #32

Earlier quoted context omitted.

Bruce Schneier's summarization [0] of NIST's revised recommendations: 1. Stop it with the annoying password complexity rules. They make passwords harder to remember. They increase errors because artificially complex passwords are harder to type in. And they don't help that much. It's better to allow people to use pass phrases. 2. Stop it with password expiration. That was an old idea for an old way we used computers.…

Unfortunately my company claims their credit card and electronic payment processing agreements require employee password to expire. If that’s actually true, then most companies hands are tied until those payment agencies update their requirements.

This is true, PCI DSS still requires password expiry.

The trick is figuring out the boundary of the systems that are subject to PCI.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#186

Post by gbronner »

Most policies don't let you reuse the last N passords (N is often 5 or 10). So standard practice is to start or end the password with a digit and increment it when you are forced to. Better yet, digits are on the top row with the symbols, so you can knock off 2+ categories without moving your fingers.

Most employees have a sincere desire to their work with a minimum of fuss, and this does pretty well.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#187

Post by notlukesky »

rb808 wrote: post #116

My company has started using 2fa for every intranet app, so I have to get my phone out a few times a day. Its going nuts.

SAASPASS can AutoFill both the passwords and the Authenticator codes as well.

https://saaspass.com/

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#188

Post by 14 »

mint2 wrote: post #184
orand wrote: post #32

Earlier quoted context omitted.

Bruce Schneier's summarization [0] of NIST's revised recommendations: 1. Stop it with the annoying password complexity rules. They make passwords harder to remember. They increase errors because artificially complex passwords are harder to type in. And they don't help that much. It's better to allow people to use pass phrases. 2. Stop it with password expiration. That was an old idea for an old way we used computers.…

Unfortunately my company claims their credit card and electronic payment processing agreements require employee password to expire. If that’s actually true, then most companies hands are tied until those payment agencies update their requirements.

I would love to know my companies reasoning. I work for a huge health care provider and everyone from care workers to the nurses in our office have to change our passwords each 6 weeks. Myself and others just keep the same passwords and increase the number at the end. Currently we keep getting these emails from IT telling us security threat level is high and don’t click links from unknown locations. The system is buggy to add to is all so people are constantly getting locked out and they call IT who helps change to another password. After having to do it so often so many times most of us just don’t care anymore. My password is kind of complex and in the middle I have a number that I just increase each time.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#189

Post by xmprt »

nickthegreek wrote: post #55
trianglem wrote: post #52

Earlier quoted context omitted.

I agree with all of this except password managers. If you use a lot of different public computers or temporary work laptops they don’t always let you install LastPass, so I frequently ended up being unable to access my accounts.

I access my manager from my phone and type them in. I would never install my LastPass on a public computer even if they let me.

Pardon my ignorance but if you're worried about the computer being compromised so that they could somehow access your LastPass, why would you even use it for any authenticated work in the first place?

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#190

Post by all_blue_chucks »

AdmiralAsshat wrote: post #64

No sympathy for the organizations that implement these stupid password requirements in the first place. a) Passwords that are secure. b) Passwords that can be remembered. c) Passwords that must be rotated regularly. You can pick two of the above, and it can be done. But you're not getting all three.

You should have some sympathy. Outdated regulatory standards like PCI:DSS require things like this. It isn't always your employer's choice.
Post reply on HN