Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password expiration is dead, long live passwords

techcrunch.com

Post reply on HN
Print view View original

101–110 of 316 posts

Re: Password expiration is dead, long live passwords

#101

Post by bscphil »

tomglynch wrote: post #84
LeoPanthera wrote: post #23

Earlier quoted context omitted.

What I do: 1. Check the password against the haveibeenpwned.com database. 2. Check the password with the zxcvbn password strength library. If it passes both they can use it. It's not perfect, but it's a lot better than nothing.

I don't think checking against haveibeenpwned is a good idea. They recommend against checking your current password, and you're automatically checking every users current password?

You can download a database from haveibeenpwned of SHA-1s of all the passwords, which is the only way you should be checking user passwords against an external database. It's also a good way!

Re: Password expiration is dead, long live passwords

#102

Post by mruts »

extra88 wrote: post #66
CrowFly wrote: post #35

Earlier quoted context omitted.

I have 2 and 3 year CDs in a bunch of banks. (This is a common use case, people open separate accounts because of the FDIC insurance limit in any one bank). I only need to log in again 2 or 3 years after opening the account to either take the money out, or open another CD. Some of these banks expire passwords every 6 months! That's insane. I have calendar reminders set to remind me to log in and generate another pass…

*A common use-case for millionaires. FDIC limits are $250,000 per-institution, per-account owner, per-account type (CD, money market, savings, checking) and my understanding is joint accounts are considered separate owners so two spouses could have up to $750,000 in CDs at a single bank and be fully insured.

30% of households have an aggregate net worth above 250k. So the situation GP in describing is probably very common.

Re: Password expiration is dead, long live passwords

#103

Post by matt_morgan »

EnderWT wrote: post #53

"Periodic password expiration is a defense only against the probability that a password (or hash) will be stolen during its validity interval and will be used by an unauthorized entity. If a password is never stolen, there’s no need to expire it. And if you have evidence that a password has been stolen, you would presumably act immediately rather than wait for expiration to fix the problem." Full post: https://blogs.…

This ignores the fact that most people use the same password everywhere, given the opportunity, and you have no idea what website has been breached. I.e. if you don't expire passwords, most people will use the same password everywhere, and you don't know when a compromise has happened, because it happened on some totally other network.

Re: Password expiration is dead, long live passwords

#104

Post by makecheck »

Not only are expirations pointless but it’s ridiculous that a 24-hour expiration system is often paired with a “Monday-Friday, 9-4 Eastern” kind of phone call.

I once had an investment account lock out at the start of a weekend and I couldn’t log into the damn thing for days simply because their robot shut it off and only a working human would turn it on.

Re: Password expiration is dead, long live passwords

#105

Post by bscphil »

jeremyjh wrote: post #17
discreditable wrote: post #12

I still expire passwords on a yearly basis for the sole reason that users have complained to me that it stops them from using the password they use for everything else.

I came here to say this. I can't think of another way to guarantee that they aren't using the same password that they use on every website they've visited since 1997. If anyone has suggestions on this I'd love to hear it.

Some possibilities off the top of my head (some suggested here already):

* Test for password strength (most reused passwords are weak)

* Test for password existence in public databases (and recheck on database updates when they log in)

* Automatically generate a secure password for your users at the account creation stage and require them to use it

* Use a login method more sophisticated than just username / password to mitigate against password reuse

* Expire the first password they enter instantaneously, but then never expire again.

* Set an exact length requirement of between 16 and 20 characters inclusive. (Don't actually do this, but it's better than password expiry.)

* If your users are also your employees, make them responsible if their password is compromised while training them in proper password use.

I don't know, it just seems to me like basically any solution, including doing nothing, is better than expiring passwords. Even if it forces a few people to not reuse a password and there were no other way to achieve the same result, the tradeoff of worse security that results would make it not worth it.

Re: Password expiration is dead, long live passwords

#106

Post by manigandham »

jsonau wrote: post #79

Another worst offender are security questions to unlock accounts. Answers to these questions are usually visible to customer service reps and similar set of questions are asked among different services. This is scary. It's dangerous as having password stored in plain text as answers to the security questions can potentially unlock many other accounts. I highly suggest everyone answers each of them with a unique answe…

I use fake answers. Treat them as basically secondary passwords. I do keep them as real words though since sometimes they need to be answered over the phone and you don't want to read a long random string of characters.

Re: Password expiration is dead, long live passwords

#107

Post by bscphil »

Someone1234 wrote: post #93
XorNot wrote: post #88

Earlier quoted context omitted.

I've long since started just putting in random password strings for these.

I used to also, until this blew up in my face. Put random stuff as the security answers in my Trial World of Warcraft account in 2005. In order to merge it into my Battle.net 2.0 account around 2009 I needed to know it, and even though I had the correct password there was no way to change security questions and I had to beg customer support (which was a long process, involving software serial numbers, scans of ID, th…

I assume when people suggest putting random strings in these fields, it's implied that you're supposed to save that data in a password manager or something. Mine (KeePassXC) supports storing arbitrary data as "notes" in each entry, along with TOTP information (great as a backup in case you lose your phone), and other stuff.

I worry more that a particularly dull customer support agent is likely to be convinced by a random caller to reset the password if they can see that those fields are garbage.

Re: Password expiration is dead, long live passwords

#108

Post by Raistael »

hackinthebochs wrote: post #61
Raistael wrote: post #48

Earlier quoted context omitted.

This is largely true, but we also exist in a day and age where computing clusters can fire off billions of guesses per second. Anything less than 16 digits takes a questionably small amount of time in comparison, when paired with some of the more advanced attack vectors.

2FA is the solution. That way the password is only to protect against someone who physically has access to your keyfob (nosey coworker, thief, etc). Thinking of passwords as the solution to protect against sophisticated actors is the mistake.

Properly implemented 2FA, for sure. Having been on both sides of various types of 2FA failures, but I definitely agree.

Re: Password expiration is dead, long live passwords

#109

Post by shakna »

omh wrote: post #26
LeoPanthera wrote: post #23

Earlier quoted context omitted.

What I do: 1. Check the password against the haveibeenpwned.com database. 2. Check the password with the zxcvbn password strength library. If it passes both they can use it. It's not perfect, but it's a lot better than nothing.

How are you implementing these checks? I'm using Active Directory and options for extra password checks are somewhat limited.

If you have the DS-Replication-Get-Changes permission, you can exploit dc-sync through something like mimikatz [0] to grab the password hashes out of Active Directory, so you can run your checks.

[0] https://github.com/gentilkiwi/mimikatz

Re: Password expiration is dead, long live passwords

#110

Post by marzell »

Retric wrote: post #70
thaumasiotes wrote: post #64

Earlier quoted context omitted.

> If a password is never stolen, there’s no need to expire it. And if you have evidence that a password has been stolen We've been seeing the point "your personal information is already out there, in the hands of hackers" recently. This cleft seems oddly blind to the possibility that a password has been stolen, but you have no evidence of the fact.

If that’s the fear then all passwords should expire at the same time. Otherwise if you reset every X days, hackers will always have access to some accounts X days.

Doesn't that only matter if you use the same password for more than one account?
Post reply on HN