Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

There’s no need to change passwords if they're robust, unique and not breached

tidbits.com

Post reply on HN
Print view View original

81–90 of 288 posts

Re: There’s no need to change passwords if they're robust, unique and not breached

#81

Post by cromd »

Worth keeping in mind that passwords do actually leak. Companies have had incidents where they were inadvertently logging secrets passed to them. I've also typed/pasted secrets in the wrong field, which can get into some database or user-interface tracking tool. I've typed my sudo password instead of a vpn password at the command line, thinking sudo login had triggered when it was instead cached. Who knows when these crumbs might turn up.

And as others pointed out, breaches aren't always known or disclosed. Is it too late if you change your password 6 months after it's compromised? Not sure - maybe people sit on their exploits sometimes, or wait for a better buyer, or sell secrets in small batches.

All that said, I've never changed a password when it was newer than 5 years old, and only do it for crucial services, but if I were a bigger target, I might do it more.

Re: There’s no need to change passwords if they're robust, unique and not breached

#83

Post by kedean »

Darmody wrote: post #24
colinclerk wrote: post #7

Perhaps surprisingly, US government guidelines exist, are pretty fantastic, and agree with the author: Memorized secrets SHALL be at least 8 characters in length if chosen by the subscriber. Memorized secrets chosen randomly by the CSP or verifier SHALL be at least 6 characters in length and MAY be entirely numeric. If the CSP or verifier disallows a chosen memorized secret based on its appearance on a blacklist of c…

6 characters and entirely numeric seems like a bad idea, or am I missing something?

My reading was not that it must be entirely numeric, but that there is no rule that it won't be. As in, an attacker cannot make any assumptions about the characters in the randomly chosen password, such as "well it won't be all numbers, so lets rule out all those possibilities The 6 character limit only seems to apply to randomly assigned ones, not to ones the user picks, which is where a strategy like "what about all the number combinations" is more useful.

Re: There’s no need to change passwords if they're robust, unique and not breached

#84

Post by adventured »

jihadjihad wrote: post #76
xboxnolifes wrote: post #64

Earlier quoted context omitted.

It's not 10 because it still needs to be memorized.

I know it's hard to imagine, but before we all held supercomputers in our pockets we all used to have dozens of ten-digit numbers memorized. I still remember my grade school friends' phone numbers.

You were an extreme outlier if you bothered to memorize dozens of ten digit phone numbers in the era before everyone had a cellphone.

The average person doesn't even have ten good friends, much less a need to memorize dozens of phone numbers. They would buy address books / contact books to write down dozens of numbers, not memorize numbers they very rarely use.

Re: There’s no need to change passwords if they're robust, unique and not breached

#85

Post by e1g »

rterrin wrote: post #70
e1g wrote: post #28

In the USA, the latest government guidance from Jan 2022 is that "Password policies MUST NOT require use of special characters or regular rotation". [1] This is a strong upgrade from earlier softer language like "don't have to/should not". In practice, this new rule contradicts almost every InfoSec stance out there, but all government agencies must comply with this new rule by the end of the year, so expect lots of c…

I worked on Identity, Credentialing and Access Management (ICAM as it's known) in the Federal space for a while. The U.S. Fed Gov has been implementing MFA with smart cards since 2001. While there are pockets of ineptitude and resistance, the vast majority of government employees and contractors use a hard token second factor. Security is a property of a system, so analyzing a particular password policy outside of th…

Yes, and the latest Zero-Trust guidance is actually legitimately good - it enforces a security practice on all gov agencies that will be better than 99% of the private sector. The password policy is just one line, but still a welcomed slap on the face of all Old Guard folks (who are overrepresented in infosec policy-making). The rule is clear: MFA or GTFO.

Re: There’s no need to change passwords if they're robust, unique and not breached

#86

Post by kube-system »

seanw444 wrote: post #63
Darmody wrote: post #24

Earlier quoted context omitted.

6 characters and entirely numeric seems like a bad idea, or am I missing something?

That provides one million possibilities. I don't think you're missing anything. That's pretty terrible. The only thing prolonging your account at that point is the service's rate-limiting, assuming a naive "enter this password in the login field, try it, repeat."

On the other hand, if you have too many password requirements and the user can’t remember it, they often lean on bad password hygiene, and the password ends up being reused (and inevitably leaked) or written down somewhere.

Re: There’s no need to change passwords if they're robust, unique and not breached

#87

Post by Semaphor »

jihadjihad wrote: post #76
xboxnolifes wrote: post #64

Earlier quoted context omitted.

It's not 10 because it still needs to be memorized.

I know it's hard to imagine, but before we all held supercomputers in our pockets we all used to have dozens of ten-digit numbers memorized. I still remember my grade school friends' phone numbers.

I remember 2 out of the 3 landline numbers (one is my parents, still using that) I used to know, my 2 ICQ numbers, and my mobile phone number (which is still the same now, 20 years later). I never felt the need to remember a ton of numbers, that’s what phone books (digital or analog) are for and why I now use a password manager ;)

Re: There’s no need to change passwords if they're robust, unique and not breached

#88

Post by manigandham »

rubyist5eva wrote: post #41
awestroke wrote: post #22

Earlier quoted context omitted.

Go ahead and suggest an alternative

One-time use magic links sent to a verified email.

Too many extra steps, especially on mobile. And very suspectable to phishing and social engineering. Also makes it impossible to login if you lose email access (and what if you need to change your address because of it?)

Re: There’s no need to change passwords if they're robust, unique and not breached

#89

Post by amtamt »

What about an undetected data breach leaking username and passwords? Periodic password replacement reduces the window where someone's stolen password is used a long time after breach. This may not be the threat scenario for every type of accounts, but in some type it would one among the most important ones.

Re: There’s no need to change passwords if they're robust, unique and not breached

#90

Post by bombcar »

Moodles wrote: post #37

A lot of users will simply change their passwords by appending a 1, 2, 3, etc. at the end. Presumably if old passwords did sour and become compromised then Hashcat would easily crack the minor tweak on the new password. To be fair to these companies, the reason they do passwords so terribly is because of such poor guidance and standards in the past. Even now NIST has SP 800-132 for guidance on generating a cryptograp…

This is the main thing. A password leak either gets the password or gives you a basis for attacking variations of it.
Post reply on HN