There is no need for passwords. Cant we figure out something better? its only been like 50 years.
This does exist: Passwordless with FIDO2/WebAuthn has been gaining some decent traction.
There’s no need to change passwords if they're robust, unique and not breached
101–110 of 288 posts
Re: There’s no need to change passwords if they're robust, unique and not breached
#102So, really, you should change a password regularly if:
- The password is weak
- It is ever reused
- Anyone else has access to it
- You use it on a device you don't control
- You use it on a device which might be running malware and can intercept it
- It was stored insecurely
Re: There’s no need to change passwords if they're robust, unique and not breached
#103In the USA, the latest government guidance from Jan 2022 is that "Password policies MUST NOT require use of special characters or regular rotation". [1] This is a strong upgrade from earlier softer language like "don't have to/should not". In practice, this new rule contradicts almost every InfoSec stance out there, but all government agencies must comply with this new rule by the end of the year, so expect lots of c…
The "character class" requirement really doesn't add much security. And the "password rotation" policy can actually result in worse passwords than otherwise. Those measures were effectively just folk medicine from the days when the threat was thought to be someone manually trying to brute-force your password at your terminal.
Not to mention it makes it harder to use the password in automated systems, as lots of places try to parse (or can't encode properly) $, /, -, and others.
Re: There’s no need to change passwords if they're robust, unique and not breached
#104I hate password rotation rules. Companies have iT departments that love nothing more than to add "value" by adding their own spin on what password security should be. It's pure security theater. At every company I've ever worked that required password rotation, everyone just incremented a digit, usually at the end. I also hate the completely arbitrary rules on length (I mean, why do some sites have a maximum length?)…
I use parts of song lyrics or movie quotes for most my passwords, and I do the same with increasing a digit. I'm at digit change 17. The thing that REALLY kills me is when a password has a maximum length.
Re: There’s no need to change passwords if they're robust, unique and not breached
#105Worth keeping in mind that passwords do actually leak. Companies have had incidents where they were inadvertently logging secrets passed to them. I've also typed/pasted secrets in the wrong field, which can get into some database or user-interface tracking tool. I've typed my sudo password instead of a vpn password at the command line, thinking sudo login had triggered when it was instead cached. Who knows when these…
> Is it too late if you change your password 6 months after it's compromised?
I'd say no... some compromises are "2 step"... Ie. someone accidentally was logging the passwords in plaintext for a few months to some logs system (compromise 1)... and then years later some attacker breaks into the logs system (compromise 2).
Or you accidentally typed a password into a terminal and it got stored in your .bash_history... and then months later you accidentally make your dotfiles github repo public, including your .bash_history containing your password...
Also, some thieves may compromise your account but not do much evil with it (and remain undetected). And then many months later they sell your account to someone else who does do evil with it.
Re: There’s no need to change passwords if they're robust, unique and not breached
#106I encourage everyone in a position to run into this discussion internally to memorize a few key sections of NIST 800-63. It's come in handy more than once...
Re: There’s no need to change passwords if they're robust, unique and not breached
#107Earlier quoted context omitted.
It's not 10 because it still needs to be memorized.
I know it's hard to imagine, but before we all held supercomputers in our pockets we all used to have dozens of ten-digit numbers memorized. I still remember my grade school friends' phone numbers.
You didn't memorize ten random digits. Area code, exchange, four digit extension is six things...
Area code was likely all the same, maybe 2-3 tops, and associated both with the following exchange and geography, and used extensively.
Exchange, also likely all the same, maybe 6 at most, and again likely associated with geography.
Re: There’s no need to change passwords if they're robust, unique and not breached
#108Earlier quoted context omitted.
The "character class" requirement really doesn't add much security. And the "password rotation" policy can actually result in worse passwords than otherwise. Those measures were effectively just folk medicine from the days when the threat was thought to be someone manually trying to brute-force your password at your terminal.
> The "character class" requirement really doesn't add much security. If you're generating your passwords randomly (using a password manager) it actually reduces security because it reduces the set of acceptable passwords.
That might be the only way to guarantee secure passwords across a platform/company. Of course, then you have to make sure people don't write it on sticky-notes under their desks...
Re: There’s no need to change passwords if they're robust, unique and not breached
#109I've been saying this for years.
Whoever came up with the idea that passwords need to be regularly changed must be shot because no one has ever proved it makes any sense.
What it actually does is that people write passwords everywhere (papers, text files, etc), thus actually lowering their security.
Re: There’s no need to change passwords if they're robust, unique and not breached
#110Earlier quoted context omitted.
I know it's hard to imagine, but before we all held supercomputers in our pockets we all used to have dozens of ten-digit numbers memorized. I still remember my grade school friends' phone numbers.
You were an extreme outlier if you bothered to memorize dozens of ten digit phone numbers in the era before everyone had a cellphone. The average person doesn't even have ten good friends, much less a need to memorize dozens of phone numbers. They would buy address books / contact books to write down dozens of numbers, not memorize numbers they very rarely use.
Or even more niche in your outlier status if you could remember IPs of the commonly used servers without a DNS in place.
Most of the time, local networked IPs all start with the same values for the first 3 octets (maybe 2 if VLAN but then usually only one digit diff). The same was true for most people's local phone number memorized registry. Those of us old enough, we only had to dial 5 digits using (70s) the last number of the prefix before eventually moving to 7 digits to include the full prefix (80s). The world suddenly changed when we had to dial the entire area code as well (90s).