Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

49% of workers, forced to change passwords, reuse same one with minor change

grahamcluley.com

Post reply on HN
Print view View original

301–310 of 316 posts

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#301

Post by Dylan16807 »

clarry wrote: post #300
Dylan16807 wrote: post #299

Earlier quoted context omitted.

> At what point would they exhaust their bruteforce capability or decide that they've probably got the wrong pattern and go for another one? Go in increasing order of difficulty. Or estimated rarity based off of password dumps. Something like: One character, two characters, one word, one word plus a character, one character plus a word, one modified word, three characters, etc. "word" being a list of most common word…

> That would just be "four words plus five random characters". Aye.. if you were going to pick the simplest (most bruteforceable) pattern first, you wouldn't want five random characters now, would you? I thought that's the whole point of this exercise :-) Of course I could decide to repeat that bit pattern four times and that adds no entropy if the pattern is assumed to be fixed, but then we get back to having the at…

The pattern entropy matters, but it's much smaller than the entropy from the actual words and characters.

Don't try to outsmart the person cracking the password. Assume whatever clever scheme you come up with is relatively common. If only 0.05% of passwords use it, that's still less entropy than adding two more characters. And it's a lot safer to underestimate than overestimate.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#302

Post by guitarbill »

jimnotgym wrote: post #279
orand wrote: post #32

Earlier quoted context omitted.

Bruce Schneier's summarization [0] of NIST's revised recommendations: 1. Stop it with the annoying password complexity rules. They make passwords harder to remember. They increase errors because artificially complex passwords are harder to type in. And they don't help that much. It's better to allow people to use pass phrases. 2. Stop it with password expiration. That was an old idea for an old way we used computers.…

I totally agree that password expiry is a problem, however I have twice taken over AD based systems where there was widespread password sharing, and I found IT knew a lot of passwords of users. I found that a one off change didn't help, they all just updated each other. So my advice is to advise people that they will get resets. To run them through a couple with increasing complexity requirements. Then increase the p…

While decreasing rotation frequency is definitely good, I'm not quite sure how is this supposed to help reuse? People will do what they need to to get their job done, exactly the finding of the article. Would be better to tackle the root cause by e.g. having shared, federated accounts or roles. Of course, it's easy to say, but should be worth it in the long run.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#303

Post by rightbyte »

KC8ZKF wrote: post #183
JackRabbitSlim wrote: post #107

Earlier quoted context omitted.

IBM legacy in action. Nobody ever got fired for buying IBM, but some of them probably should have been.

IBM? AT&T, more likely. Unix had an 8 character limit long after people knew better.

Nothing would surprise me less than banks implementing a bank user accessing the bank via the website as a Unix user on a system.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#304

Post by ec109685 »

tomp wrote: post #264
ec109685 wrote: post #241

Earlier quoted context omitted.

If an attacker has root on a public computer, a QR code is easily hackable as well: just man in the middle the scan process. So while you are logged in, the attacker can do anything they want.

That’s true regardless of the login method. The benefit of the method I described is that you can 100% log out without any MITM, as you initiate the logout from a trusted device

Yeah, agreed.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#305

Post by kazinator »

ProZsolt wrote: post #272
kazinator wrote: post #168

Earlier quoted context omitted.

If you ask me to memorize a 32-character random string every 6 months, I will memorize a 31-character string, plus one incrementing character.

The funny thing when they don't allow you to do that. They throw an error something like "Your password is too similar to the previous password". Then I know they store it in plain text.

Do we know that? We actually do not.

If I have some previous passwords of yours in hashed form, and you give me a new password, what I can do is try to crack your previous passwords by generating nearby passwords based on the new one.

For instance, if you give me something that ends in a digit, I can substitute the other nine digits into that and try all those passwords against your prior hashes.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#306

Post by nicky0 »

iudqnolq wrote: post #243
nicky0 wrote: post #242

Earlier quoted context omitted.

How does the communication from the computer to the phone work?

No idea. Presumably a push notification. Within less than a second providing your email (on fast US data) you get a prompt on your phone that shows the browser model and approx location and asks you to approve or disapprove the login. They initially rolled it out as a 2FA option, then as an optional for 1FA.

OK so you have to actually type your email into the computer.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#307

Post by iudqnolq »

nicky0 wrote: post #306
iudqnolq wrote: post #243

Earlier quoted context omitted.

No idea. Presumably a push notification. Within less than a second providing your email (on fast US data) you get a prompt on your phone that shows the browser model and approx location and asks you to approve or disapprove the login. They initially rolled it out as a 2FA option, then as an optional for 1FA.

OK so you have to actually type your email into the computer.

Exactly. Google already asked for email alone and then password on the next page so that they could support sending enterprise emails to custom login systems.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#308

Post by Liskni_si »

orthros wrote: post #105

My work required me to change passwords every 90 days. I worked there for 8 years. My first password was [password]1 and my last one was [password]34. I'm guessing this isn't what they had in mind.

There's actually no need to really change the password. The check for used passwords has its limits, so after going through [password]1 to, let's say, [password]20, it lets you use [password]1 again. A script (for loop with smbpasswd, for example) can do this in a few seconds.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#309

Post by tracker1 »

cgriswald wrote: post #117
tracker1 wrote: post #109

My single biggest issue is weird complexity requirements... let me simply use a relatively short sentence (15+ characters). If they limited requirement to length only + a breach check, that would be enough and encourage a sentence. "I really like sour grapes." is easy enough to remember and has plenty of complexity... of course, it gets much harder on a mobile device, this is where passphrase managers come into play…

Random words, yes. With random words, you've turned your set of 40 or so symbols into a set of 150K or so symbols, so it's fine that you've got fewer of them in your password. I'm skeptical about actual sentences. With an actual sentence more common words will be chosen (so a smaller set of symbols), it will have a structure (no need for an attacker to try, for instance 'noun noun noun noun noun'), and people will pr…

I was just giving an example... there are a nearly infinite number of sentences out there, even if they share a common structure. That said, it doesn't have to make sense and I'd be okay with "noun noun noun noun noun" for that matter. The point is, you hit a point where it's good enough and even then if you really need more security that's where MFA strategies come into place.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#310

Post by loeg »

ProZsolt wrote: post #272
kazinator wrote: post #168

Earlier quoted context omitted.

If you ask me to memorize a 32-character random string every 6 months, I will memorize a 31-character string, plus one incrementing character.

The funny thing when they don't allow you to do that. They throw an error something like "Your password is too similar to the previous password". Then I know they store it in plain text.

You could imagine a scheme where they just store N salted hashes of your N-character previous password with 1 character deleted. Then at password changes, they do the same iteration with the candidate password and see if any digests match. This tells them if you made a 1 character change to your password, without storing your old password in plaintext.
Post reply on HN