Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password expiration is dead, long live passwords

techcrunch.com

Post reply on HN
Print view View original

11–20 of 316 posts

Re: Password expiration is dead, long live passwords

#11

Post by pishpash »

Raistael wrote: post #3

I'm not entirely sure that I'd agree with this mentality. Sure, at a glance it sounds good. If the password has been safeguarded, there's really not much reason to force expiration. However, wouldn't the age of the password reduce the security of it by default? The longer a password exists for, the more likely it is that it can be cracked, discovered by a misplaced Post-It note, or compromised by some other unknown s…

You can't force entropy out of people when there is only so much, regardless of how often you believe you're make them "change" passwords.

Re: Password expiration is dead, long live passwords

#13

Post by Raistael »

MithrilTuxedo wrote: post #9
Raistael wrote: post #3

I'm not entirely sure that I'd agree with this mentality. Sure, at a glance it sounds good. If the password has been safeguarded, there's really not much reason to force expiration. However, wouldn't the age of the password reduce the security of it by default? The longer a password exists for, the more likely it is that it can be cracked, discovered by a misplaced Post-It note, or compromised by some other unknown s…

I think password expiration came about before two-factor authentication was as easy to use as it is now. Security concern around password age would be mostly obviated by 2FA.

Mostly, if implemented properly, sure. I would agree with this.

Re: Password expiration is dead, long live passwords

#14

Post by acidburnNSA »

I sent in the NIST announcement to enterprise sysadmins last year as an opportunity for improvement. They closed as wontfix. I dont blame them for moving slow. This hopefully will move them a little.

They have a guy whose job is basically to deal with unlocks after password changes.

Re: Password expiration is dead, long live passwords

#15

Post by thrower123 »

davemp wrote: post #2

I've always wondered how many engineer hours have been lost on the phone with helpdesks sorting out expired passwords.

It's an insane amount. I've worked on writing helpdesk software for almost a decade now, and from time to time we are asked by our customers to run some analysis on their data; password resets are usually from 25% to 50% of the total requests to the system.

Re: Password expiration is dead, long live passwords

#16

Post by jaabe »

We’re required to have password expiration by law in the public sector of Denmark. So I’m sure we’ll continue to have it for at least some years to come.

I must admit I never really understood the function of it. Obviously lifetime access is more damaging than 3 months access, but the truly devastating thing is the unauthorised access itself not the length of it. Also the policy results in really bad practices like people using summer2019 as their password or writing their current password down on post it’s. We tried blocking stuff like summer2019, but people get really creative. People also forget to renew their passwords, costing hundred of hours in the process.

We have 2FA now, which will soon be required by our adoption of the GDPR, but you have to wonder why we didn’t get that decades ago instead of the password expiration.

Re: Password expiration is dead, long live passwords

#17

Post by jeremyjh »

discreditable wrote: post #12

I still expire passwords on a yearly basis for the sole reason that users have complained to me that it stops them from using the password they use for everything else.

I came here to say this. I can't think of another way to guarantee that they aren't using the same password that they use on every website they've visited since 1997. If anyone has suggestions on this I'd love to hear it.

Re: Password expiration is dead, long live passwords

#18

Post by cjensen »

discreditable wrote: post #12

I still expire passwords on a yearly basis for the sole reason that users have complained to me that it stops them from using the password they use for everything else.

That's amusing but... those same users are likely to be using just altering their passwords a little like "passwd1" "passwd2", etc. You aren't gaining anything.

Re: Password expiration is dead, long live passwords

#19

Post by xixixao »

jeremyjh wrote: post #17
discreditable wrote: post #12

I still expire passwords on a yearly basis for the sole reason that users have complained to me that it stops them from using the password they use for everything else.

I came here to say this. I can't think of another way to guarantee that they aren't using the same password that they use on every website they've visited since 1997. If anyone has suggestions on this I'd love to hear it.

I'm not an expert, but you could integrate DBs like https://haveibeenpwned.com/Passwords to make sure users don't use exposed passwords?

Re: Password expiration is dead, long live passwords

#20

Post by LeoPanthera »

jaabe wrote: post #16

We’re required to have password expiration by law in the public sector of Denmark. So I’m sure we’ll continue to have it for at least some years to come. I must admit I never really understood the function of it. Obviously lifetime access is more damaging than 3 months access, but the truly devastating thing is the unauthorised access itself not the length of it. Also the policy results in really bad practices like p…

I briefly worked at a place that enforced quarterly password changes and I literally used as my password. I am not good at remembering passwords and I don't think I'm that unusual. Writing them down seemed worse than using a poor password that I can at least remember.

Probably these days if forced I would use . I don't know how much better that is. But luckily now I work for myself.

Post reply on HN