49% of workers, forced to change passwords, reuse same one with minor change • Hacker News Board

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#261

Post by joyjoyjoy » Sat, Dec 14, 2019, 9:55 AM UTC

joyjoyjoy wrote: post #260

hwbehrens wrote: post #7

This should not be a surprise, as this supports the NIST's revised recommendations (from June 2017!) that passwords should not expire [0], because it actually leads to less-secure passwords for this exact reason. Furthermore, many corporate systems do not integrate well with password managers, such as when first logging in to your system in the morning. This means that the password is likely to be one of the few that…

"This should not be a surprise, as this supports the NIST's revised recommendations (from June 2017!) that passwords should not expire [0], because it actually leads to less-secure passwords for this exact reason." THIS. 10 Times This. Would somebody be so kind to tell this to the eRA Commons website maintainer of the NIH? And when you are one it, please tell eBay I don't want to change my PW if they think someone el…

And since we are on it, if I had a wish I would wish a nerd password option for one time passwords based on regular expressions.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#262

Post by pteraspidomorph » Sat, Dec 14, 2019, 10:12 AM UTC

Dylan16807 wrote: post #148

akira2501 wrote: post #97

Earlier quoted context omitted.

To me, there's an irony in that "Zaphod Beeblebrox's kite harasses Tuscon." is not only _more_ memorable on it's own, but is probably a _better_ password than "ZBw3hHg1tFWdhdt?Hoh2hXcrZmn" Stop using passwords, just use a "pass sentence." My last few passwords at my previous employer: "Tim, bring me chicken #15" "Mary, stop looking at me!" "Nothing you can do about 2!" "The coffee here is gross." Seriously.

There's absolutely no way a five word password is better than 32 random characters. Two plain old random words, the entropy of that is less than 16 bits each, but we'll round up. One of the biggest cities in the US is probably even less useful, but let's credit it for 16 bits. And let's rate Zaphod Beeblebrox as one-in-a-million for entropy purposes. That's 68 bits. It's somewhere between 11 and 12 random alphanumeri…

I ran a few tests with zxcvbn using five words (only nouns and verbs) and it estimates the complexity at roughly the same as that of a 32 random alphanumeric character password with capitals. Is zxcvbn wrong?

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#263

Post by tialaramex » Sat, Dec 14, 2019, 10:18 AM UTC

zamalek wrote: post #220

sitharus wrote: post #185

Earlier quoted context omitted.

This is true, PCI DSS still requires password expiry. The trick is figuring out the boundary of the systems that are subject to PCI.

I think we have it for one of the ISO compliances, too.

The ISO 27xxx standards in Information Security don't tell you how to do it, they tell you how to formalise what you decided to do (and how it can be monitored, audited, etc.). So the reason your ISO compliance forces you to do password rotation is that some twit added "password rotation" to the policies you decided you were going to implement. New task: Find the relevant policy and revise it citing the modern NIST guidance. Extra credit: Go through other policies that get in your way, figure out why they're in there and either you'll be reconciled to this annoyance in your life or you can revise the policy to not be a problem.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#264

Post by tomp » Sat, Dec 14, 2019, 10:18 AM UTC

ec109685 wrote: post #241

tomp wrote: post #182

Earlier quoted context omitted.

No you still need a password, which also makes it insecure on a public computer (where keyloggers might be installed). Instead, the better solution would be, you point your phone to a QR code on the computer screen, press “confirm”, the computer is magically logged in, until you then press “log out” on your phone and the computer is logged out.

If an attacker has root on a public computer, a QR code is easily hackable as well: just man in the middle the scan process. So while you are logged in, the attacker can do anything they want.

That’s true regardless of the login method. The benefit of the method I described is that you can 100% log out without any MITM, as you initiate the logout from a trusted device

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#265

Post by tialaramex » Sat, Dec 14, 2019, 10:54 AM UTC

tatersolid wrote: post #198

sitharus wrote: post #185

Earlier quoted context omitted.

This is true, PCI DSS still requires password expiry. The trick is figuring out the boundary of the systems that are subject to PCI.

> This is true, PCI DSS still requires password expiry. We’ve been using a compensating control of “our password policy is exactly NIST SP 800-63B (2017) plus two more characters in Min length” for our PCI audits since the revision was published in 2017. It’s been accepted three times so far.

Yes. When a policy is crazy, the Right Thing is to find out how to either alter that policy or obtain an authorised deviation from it as tatersolid describes.

If you spend an hour a month on something that's required by policy and in your opinion shouldn't be, then six hours invested finding the person who sets that policy and explaining why it's a terrible idea may free up net six extra hours of your life within a year.

That story where the guy comes down a mountain with a stone tablet with Ten Commandments carved into it is (a) a myth and (b) no kind of a way to set effective policy. People can't even agree on what his Ten Commandments were, let alone on following them.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#266

Post by AmericanChopper » Sat, Dec 14, 2019, 10:56 AM UTC

cortesoft wrote: post #202

tatersolid wrote: post #198

Earlier quoted context omitted.

> This is true, PCI DSS still requires password expiry. We’ve been using a compensating control of “our password policy is exactly NIST SP 800-63B (2017) plus two more characters in Min length” for our PCI audits since the revision was published in 2017. It’s been accepted three times so far.

As always with PCI, it depends on your auditor.

Using NIST password guidelines as a compensating control has been accepted by every assessor I’ve dealt with (even the really bad ones). A compensating control must exceed the requirements of the control its compensating for, and the NIST rules clearly do. I’d say it has much more to do with how you write your compensating control worksheet rather than anything else. If you assessor is refusing to accept compensating controls, you should report them to the SSC, and then find a new assessor.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#267

Post by tialaramex » Sat, Dec 14, 2019, 11:08 AM UTC

mcny wrote: post #237

javajosh wrote: post #233

Earlier quoted context omitted.

I think he means that a password manager (PM) renders the other two points moot. Password expiry? No problem - my PM generates a new one easily. Complex rules? No problem - my PM will follow any rules you like. My response is that not everyone uses a PM, so the other two points are not moot. Also, FWIW, I find myself rather uneasy about using a PM, so the other two points aren't moot, at least for me. "One password t…

Sorry but I don’t understand how I’d use a password manager to unlock my computer. This password is for my active directory account and I hate that it expires every three months.

Try to get the AD policy revised. Because there is (since 2017) clear NIST guidance saying not to do this, chances are that somewhere in your organisation a document can be updated to cite that NIST guidance and then the AD controls can be relaxed to let passwords have the same lifetime as the account they're for. Finding who owns this policy and getting them to fix it may take a bit longer than one of those 90 day password changes, but it'll feel like you made the world better and it may only take a phone call or an email to the right person.

Newer Windows AD builds have FIDO2 support, so on shiny new computers you _could_ unlock "your" computer (one you've logged into recently) with a FIDO2 USB key, or a fingerprint reader. That's a much nicer way to unlock a computer you use all the time, while not discouraging you from using a nice long password that bad guys would need to guess or steal to get in from a different machine.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#268

Post by tatersolid » Sat, Dec 14, 2019, 11:11 AM UTC

cortesoft wrote: post #202

tatersolid wrote: post #198

Earlier quoted context omitted.

> This is true, PCI DSS still requires password expiry. We’ve been using a compensating control of “our password policy is exactly NIST SP 800-63B (2017) plus two more characters in Min length” for our PCI audits since the revision was published in 2017. It’s been accepted three times so far.

As always with PCI, it depends on your auditor.

Yes, if you’re not actually doing the “compare password against breach lists” part of SP 800-63B regularly they likely won’t accept it.

I hope forced expiry will be gone from next PCI revision anyway.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#269

Post by tibbydudeza » Sat, Dec 14, 2019, 11:16 AM UTC

Windows domain and 13 separate SAP logon's for the various products I work on in Dev, QA and Regression as single SAP signon either costs too much money or is hard to get right.

It has became a monthly ritual to reset them all when I got back from holiday as I have forgotten them after 2 weeks away.

I tried various password managers and they all suck to some degree.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#270

Post by jankiehodgpodge » Sat, Dec 14, 2019, 11:18 AM UTC

iudqnolq wrote: post #218

Aloha wrote: post #194

Earlier quoted context omitted.

Which is why at a previous employer, everyone just stuffed all of it in a spreadsheet, with expiry dates, and last logged in times.

That actually sounds pretty secure, if the computer had a reasonable password and FDE you've just implemented a hacky password manager. Even without FDE you're better than anyone who writes it down on a sticky or uses something trivial. Unless they're using Excel functions to generate password{n++} . That'd be clever and yet horrid at the same time.

Although at most workplaces your documents are just a folder on a shared drive somewhere, which may not be secured well and in some cases not secured at all.