Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

49% of workers, forced to change passwords, reuse same one with minor change

grahamcluley.com

Post reply on HN
Print view View original

211–220 of 316 posts

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#211

Post by tomc1985 »

Oh for fucks sake, why do people want to make using passwords so difficult?

No I don't want to memorize a unique string of random gibberish for every new thing I log in to

No I don't want to use your shitty password manager with its half-baked integrations that leave me hanging 30% of the time

No I don't want to come up with special variants of the passwords I know because you have some stupid complexity requirement

Nearly every attack short of actually knowing the password can be mitigated with 2FA, proper hashing+salting, thoughtful lockout policies, and rate limiting.

Why are there so many people who want security to suck so much?

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#212

Post by duelingjello »

I'd say require using one of a list of 2-3 password managers. Then, the user has a master password that they can change if they want to, and can change individual passwords with less effort. Allow writing master password on a slip of paper kept in their wallet for a couple of weeks until they memorize it.

Within the password manager, there needs to be a way to automatically login to their email account to verify accounts and change lost passwords AND a standard way (Call it PWMAPI - the Password Management API) to change passwords non-interactively within every service. Then, with one button in the password manager, it can change all passwords at once, within a few seconds, while keeping backups of old passwords in case anything fails. Heck, make it an automatically scheduled periodic job the user can be notified to do.

This is how to make things easier.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#213

Post by rootusrootus »

I'd bet it's more than 49%, to be honest. Everyone I know does it. Pick a good password, add a digit to the end, then just increment until it rolls back around. Ta-da!

Our IT server team has been using Microsoft's best practices from the 90s or so, and never bothered to modernize.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#215

Post by iudqnolq »

tomp wrote: post #182
fragmede wrote: post #112

Earlier quoted context omitted.

Which, to be fair, is close to how it works inside Apple's walled garden. Logging into iCloud on a new computer will cause the iPhone attached to that account to pop-up a "confirm login" dialog, so the second factor for login is as unobtrusive as possible.

No you still need a password, which also makes it insecure on a public computer (where keyloggers might be installed). Instead, the better solution would be, you point your phone to a QR code on the computer screen, press “confirm”, the computer is magically logged in, until you then press “log out” on your phone and the computer is logged out.

Google does that without needing a QR code if you have a recent Android and haven't enabled 2FA

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#216

Post by fg6hr »

hwbehrens wrote: post #7

This should not be a surprise, as this supports the NIST's revised recommendations (from June 2017!) that passwords should not expire [0], because it actually leads to less-secure passwords for this exact reason. Furthermore, many corporate systems do not integrate well with password managers, such as when first logging in to your system in the morning. This means that the password is likely to be one of the few that…

I think anyone can memorize 32 character passwords every 6 months if one uses some scheme. I usually use long phrases from books: a phrase that means something to me is easy to remember and even if I forget it, it's easy to look it up. Such passwords can be arbitrarily long.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#217

Post by iudqnolq »

bashinator wrote: post #172
all_blue_chucks wrote: post #166

Earlier quoted context omitted.

You should never, ever, ever type a password on a public computer.

Upvote. You have no way of knowing if that computer is compromised, say with bogus root SSL certificates to allow MitM of ostensibly secure web sites.

What if you store passwords for non-ssl sites in your password manager? I have passwords for some really old mailing lists that don't use SSL and had a big warning that they're completely insecure on the page. I especially don't want to use a shared password if it has a decent chance of being compromised, but if I cared if that account got compromised I wouldn't have set it up.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#218

Post by iudqnolq »

Aloha wrote: post #194
trianglem wrote: post #52

Earlier quoted context omitted.

I agree with all of this except password managers. If you use a lot of different public computers or temporary work laptops they don’t always let you install LastPass, so I frequently ended up being unable to access my accounts.

Which is why at a previous employer, everyone just stuffed all of it in a spreadsheet, with expiry dates, and last logged in times.

That actually sounds pretty secure, if the computer had a reasonable password and FDE you've just implemented a hacky password manager. Even without FDE you're better than anyone who writes it down on a sticky or uses something trivial.

Unless they're using Excel functions to generate password{n++} . That'd be clever and yet horrid at the same time.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#219

Post by shakna »

alain94040 wrote: post #173
fluidcruft wrote: post #102

Earlier quoted context omitted.

It would be really cool if you could plug your phone in and it appeared as a USB keyboard device and you could "type" the password from the password manager that way without ever giving the computer access to anything except that password. Maybe some sort of simple USB dongle (like a yubikey) could be fed by the phone via bluetooth or nfc to do this?

That's exactly what KeoPass[1] does: a biometric key (your fingerprint), that behaves like a no-driver-needed USB dongle/keyboard. Your grandpa could use it to secure his crypto wallet. [1] https://www.keopass.com/index_en.html

> Your grandpa could use it to secure his crypto wallet.

For a certain sense of "secure". Because fingerprints aren't. Not just because you leave them everywhere, but because the way we examine fingerprints doesn't have a result that is particularly unique.

Not even at the criminal case-law level [0][1].

That fingerprints are unique is an assumption, but it doesn't match our reality. They're useful for eliminating from a known small pool, not matching against a large group.

Many of the elements we match against run in families.

[0] https://mccoll-law.com/attorney-profile/37-general/38-finger...

[1] https://www.telegraph.co.uk/science/2016/03/14/why-your-fing...

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#220

Post by zamalek »

sitharus wrote: post #185
mint2 wrote: post #184

Earlier quoted context omitted.

Unfortunately my company claims their credit card and electronic payment processing agreements require employee password to expire. If that’s actually true, then most companies hands are tied until those payment agencies update their requirements.

This is true, PCI DSS still requires password expiry. The trick is figuring out the boundary of the systems that are subject to PCI.

I think we have it for one of the ISO compliances, too.
Post reply on HN