Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

49% of workers, forced to change passwords, reuse same one with minor change

grahamcluley.com

Post reply on HN
Print view View original

311–316 of 316 posts

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#311

Post by fluidcruft »

peteretep wrote: post #103
fluidcruft wrote: post #102

Earlier quoted context omitted.

It would be really cool if you could plug your phone in and it appeared as a USB keyboard device and you could "type" the password from the password manager that way without ever giving the computer access to anything except that password. Maybe some sort of simple USB dongle (like a yubikey) could be fed by the phone via bluetooth or nfc to do this?

It would be even cooler if I could open an app on my phone, point it at a QR code on screen, and not have anything else bother me

Yeah, I actually like the way Microsoft and Google do it when it just displays notification or number on my phone. Recently I logged in to a new Windows 10 computer and I didn't even have to type a password anywhere.

Unfortunately I don't see the need to actually fill and type passwords going away any time soon.

I'm mostly complaining about having to either:

1) Install the password manager on a computer to fill in passwords. You end up typing the password manager's password into the computer which could compromise the entire database as well as give the computer other information about your accounts and website usage.

2) Otherwise you have a password manager on your phone. You have to view the password and type it into a keyboard. Typing complex passwords is a pain in the butt. It would be nice if the password manager on my phone could just somehow type it for me. Then the only thing that goes into the computer is the exact password I'm trying to use.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#312

Post by fluidcruft »

alain94040 wrote: post #173
fluidcruft wrote: post #102

Earlier quoted context omitted.

It would be really cool if you could plug your phone in and it appeared as a USB keyboard device and you could "type" the password from the password manager that way without ever giving the computer access to anything except that password. Maybe some sort of simple USB dongle (like a yubikey) could be fed by the phone via bluetooth or nfc to do this?

That's exactly what KeoPass[1] does: a biometric key (your fingerprint), that behaves like a no-driver-needed USB dongle/keyboard. Your grandpa could use it to secure his crypto wallet. [1] https://www.keopass.com/index_en.html

I guess what I wonder about there is how do you deal with various password "rules" when generating the passwords? I really have no idea what that thing is doing. How does it know which password goes to which website? How do you create multiple passwords from your fingerprint?

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#313

Post by fluidcruft »

peterburkimsher wrote: post #177
fluidcruft wrote: post #102

Earlier quoted context omitted.

It would be really cool if you could plug your phone in and it appeared as a USB keyboard device and you could "type" the password from the password manager that way without ever giving the computer access to anything except that password. Maybe some sort of simple USB dongle (like a yubikey) could be fed by the phone via bluetooth or nfc to do this?

The EspUSB Tiny can pretend to be a USB keyboard and mouse, and it fits inside a USB socket. I've built prototypes already, and I've found a manufacturer for scaling up, but it's stalled since August because of certification issues. It wouldn't be hard to add encrypted password storage to the EspUSB firmware. The difficulty is that you need to know the keyboard layout of the destination computer. Keyboards don't send…

This is why I would prefer a dumb thing that's driven by my phone via a secure channel. I view the alternative as typing my password on the keyboard.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#314

Post by dyingkneepad »

tartoran wrote: post #126
dyingkneepad wrote: post #33

Earlier quoted context omitted.

I am forced to type 2 to 3 passwords every morning. The IT rules says I can't leave my laptop in my table overnight, so I have to every day type at least the disk encryption password + my login password. And sometimes I also have to type the VPN password. That's already 2 to 3 passwords every single time . Not counting the SSH key passphrases for a lot of stuff...

Are complicated passwords take you a long time to write? Based on this calculation here's how long we waste on meaningless tasks every year: minutes minutes/month minutes/year(hours/year) 1 ~22 ~266(~4.4h) 2 ~44 ~530(~8.8h) 3 ~66 ~792(~13h) *this only takes into account business work days. If you add weekends the number goes up...

This is not only about time wasted. It's about my feelings. It is about the mental effort to memorize them, update them every 90 days (by incrementing the last digit, of course) the frustration of having to type them, and the fact that maybe this is not really the best solution to the problem, yet we're still using it in 2020. I could keep increasing this list forever. Having a strictly technical view over problems always limits what you can see.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#315

Post by tatersolid »

alanning wrote: post #275
tatersolid wrote: post #268

Earlier quoted context omitted.

Yes, if you’re not actually doing the “compare password against breach lists” part of SP 800-63B regularly they likely won’t accept it. I hope forced expiry will be gone from next PCI revision anyway.

Do you happen to have a library/tool you could recommend that helps with this or did you develop something in-house? My startup is implementing most of the NIST rec’s with the help of projects like zxcvbn but we would like to also start doing breach list comparisons so figured I’d ask.

We use the NTLM version of the haveibeenowned lists plus a power shell script from https://github.com/MichaelGrafnetter/DSInternals/blob/master...

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#316

Post by boring_twenties »

loeg wrote: post #310
ProZsolt wrote: post #272

Earlier quoted context omitted.

The funny thing when they don't allow you to do that. They throw an error something like "Your password is too similar to the previous password". Then I know they store it in plain text.

You could imagine a scheme where they just store N salted hashes of your N-character previous password with 1 character deleted. Then at password changes, they do the same iteration with the candidate password and see if any digests match. This tells them if you made a 1 character change to your password, without storing your old password in plaintext.

Yeah... they could be doing that. But these are the same people that implemented the forced password change in the first place. The overwhelming likelihood is that they're storing them in plain text, and the jury might still be out on whether that plain text is world-readable or not.
Post reply on HN