Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

49% of workers, forced to change passwords, reuse same one with minor change

grahamcluley.com

Post reply on HN
Print view View original

251–260 of 316 posts

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#251

Post by cm2187 »

ec109685 wrote: post #241
tomp wrote: post #182

Earlier quoted context omitted.

No you still need a password, which also makes it insecure on a public computer (where keyloggers might be installed). Instead, the better solution would be, you point your phone to a QR code on the computer screen, press “confirm”, the computer is magically logged in, until you then press “log out” on your phone and the computer is logged out.

If an attacker has root on a public computer, a QR code is easily hackable as well: just man in the middle the scan process. So while you are logged in, the attacker can do anything they want.

The signature of the QR code would need to be accepted by your mobile, not the public computer. I don’t think mitm the QR code process is possible if they sign it. But if the public computer is compromised, anything you log into from that computer is accessible by the attacker anyway, as long as the session is valid.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#252

Post by cm2187 »

xmprt wrote: post #189
nickthegreek wrote: post #55

Earlier quoted context omitted.

I access my manager from my phone and type them in. I would never install my LastPass on a public computer even if they let me.

Pardon my ignorance but if you're worried about the computer being compromised so that they could somehow access your LastPass, why would you even use it for any authenticated work in the first place?

Particularly if you have a working mobile connection. But there are so many work things one can’t do on a smartphone.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#253

Post by input_sh »

mcny wrote: post #237
javajosh wrote: post #233

Earlier quoted context omitted.

I think he means that a password manager (PM) renders the other two points moot. Password expiry? No problem - my PM generates a new one easily. Complex rules? No problem - my PM will follow any rules you like. My response is that not everyone uses a PM, so the other two points are not moot. Also, FWIW, I find myself rather uneasy about using a PM, so the other two points aren't moot, at least for me. "One password t…

Sorry but I don’t understand how I’d use a password manager to unlock my computer. This password is for my active directory account and I hate that it expires every three months.

So do I, and I manage the AD for my organization.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#254

Post by mongol »

lawl wrote: post #223
mongol wrote: post #209

Earlier quoted context omitted.

I also looked into this but was disappointed when I found that android support for USB HID only goes in one direction. You can attach a keyboard to your phone, but your phone cannot act like one. There are so many useful usecases for a phone like a keyboard it is too bad...

Yeah, this is why you either need to disable the android usb driver and use default linux ones (enabling which, broke the compile for the vendor kernel on my device) Or patch the android stuff to add HID support: https://github.com/pelya/android-keyboard-gadget

Yes but that rules out making a popular app out of it.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#255

Post by Izkata »

orthros wrote: post #105

My work required me to change passwords every 90 days. I worked there for 8 years. My first password was [password]1 and my last one was [password]34. I'm guessing this isn't what they had in mind.

Mine is somewhere between 30 and 50 days (been keeping track and it seems to shift around). For a while a bunch of us were able to get them to stop expiring our passwords, until upper management found out and put a stop to it.

The counter on my password is somewhere up in the 50s or 60s. (For those of us on linux, it's only used for wifi access - things like email and svn use a different, non-expiring password)

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#257

Post by 5350-uiop-1130 »

I use this time management software at work that forces me to reset my password pretty much every time I open it.

What I'd like to know; why does this software require such stringent security. Who wants to hack into my time-sheet and see how many hours I worked on some boring project.

I also have one password to login to my laptop offline, one to login when it's online and another to login to work mail as these three passwords are always out of sync. Very annoying.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#259

Post by clort »

ZainRiz wrote: post #164
hwbehrens wrote: post #7

This should not be a surprise, as this supports the NIST's revised recommendations (from June 2017!) that passwords should not expire [0], because it actually leads to less-secure passwords for this exact reason. Furthermore, many corporate systems do not integrate well with password managers, such as when first logging in to your system in the morning. This means that the password is likely to be one of the few that…

Frankly, the most surprising thing about this article is that only 49% of people do this. Do the other 51% sincerely try to change their passwords? Or maybe they were too scared to report the truth :P

I would guess a lot of them cycle through a short list of easy-to-remember passwords instead.

It might be interesting to see how many actually try to sincerely pick that new, secure, password.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#260

Post by joyjoyjoy »

hwbehrens wrote: post #7

This should not be a surprise, as this supports the NIST's revised recommendations (from June 2017!) that passwords should not expire [0], because it actually leads to less-secure passwords for this exact reason. Furthermore, many corporate systems do not integrate well with password managers, such as when first logging in to your system in the morning. This means that the password is likely to be one of the few that…

"This should not be a surprise, as this supports the NIST's revised recommendations (from June 2017!) that passwords should not expire [0], because it actually leads to less-secure passwords for this exact reason."

THIS. 10 Times This.

Would somebody be so kind to tell this to the eRA Commons website maintainer of the NIH?

And when you are one it, please tell eBay I don't want to change my PW if they think someone else tried to log into my account based on their shitty Tracking metrics. I mostly switched from Amazon to eBay but the constant PW change request really annoy me. I have one plain vanilla browser with no anti track plug-ins only for eBay.

I once send them a message, that I consider their security guy an idiot, told them to forward him my cell phone number and ask him to give me a call to discuss this PW policy. He never called. :-)

Post reply on HN