49% of workers, forced to change passwords, reuse same one with minor change

Post by pessimizer » Sat, Dec 14, 2019, 11:47 AM UTC

cgriswald wrote: post #117

tracker1 wrote: post #109

My single biggest issue is weird complexity requirements... let me simply use a relatively short sentence (15+ characters). If they limited requirement to length only + a breach check, that would be enough and encourage a sentence. "I really like sour grapes." is easy enough to remember and has plenty of complexity... of course, it gets much harder on a mobile device, this is where passphrase managers come into play…

Random words, yes. With random words, you've turned your set of 40 or so symbols into a set of 150K or so symbols, so it's fine that you've got fewer of them in your password. I'm skeptical about actual sentences. With an actual sentence more common words will be chosen (so a smaller set of symbols), it will have a structure (no need for an attacker to try, for instance 'noun noun noun noun noun'), and people will pr…

Post by ProZsolt » Sat, Dec 14, 2019, 12:18 PM UTC

pteraspidomorph wrote: post #262

Dylan16807 wrote: post #148

Earlier quoted context omitted.

There's absolutely no way a five word password is better than 32 random characters. Two plain old random words, the entropy of that is less than 16 bits each, but we'll round up. One of the biggest cities in the US is probably even less useful, but let's credit it for 16 bits. And let's rate Zaphod Beeblebrox as one-in-a-million for entropy purposes. That's 68 bits. It's somewhere between 11 and 12 random alphanumeri…

I ran a few tests with zxcvbn using five words (only nouns and verbs) and it estimates the complexity at roughly the same as that of a 32 random alphanumeric character password with capitals. Is zxcvbn wrong?

Post by alanning » Sat, Dec 14, 2019, 12:48 PM UTC

tatersolid wrote: post #268

cortesoft wrote: post #202

Earlier quoted context omitted.

As always with PCI, it depends on your auditor.

Yes, if you’re not actually doing the “compare password against breach lists” part of SP 800-63B regularly they likely won’t accept it. I hope forced expiry will be gone from next PCI revision anyway.

Post by rightbyte » Sat, Dec 14, 2019, 12:59 PM UTC

ProZsolt wrote: post #272

kazinator wrote: post #168

Earlier quoted context omitted.

If you ask me to memorize a 32-character random string every 6 months, I will memorize a 31-character string, plus one incrementing character.

The funny thing when they don't allow you to do that. They throw an error something like "Your password is too similar to the previous password". Then I know they store it in plain text.

Post by jimnotgym » Sat, Dec 14, 2019, 1:32 PM UTC

orand wrote: post #32

hwbehrens wrote: post #7

This should not be a surprise, as this supports the NIST's revised recommendations (from June 2017!) that passwords should not expire [0], because it actually leads to less-secure passwords for this exact reason. Furthermore, many corporate systems do not integrate well with password managers, such as when first logging in to your system in the morning. This means that the password is likely to be one of the few that…

Bruce Schneier's summarization [0] of NIST's revised recommendations: 1. Stop it with the annoying password complexity rules. They make passwords harder to remember. They increase errors because artificially complex passwords are harder to type in. And they don't help that much. It's better to allow people to use pass phrases. 2. Stop it with password expiration. That was an old idea for an old way we used computers.…