Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password expiration is dead, long live passwords

techcrunch.com

Post reply on HN
Print view View original

111–120 of 316 posts

Re: Password expiration is dead, long live passwords

#111

Post by panopticon »

manigandham wrote: post #106
jsonau wrote: post #79

Another worst offender are security questions to unlock accounts. Answers to these questions are usually visible to customer service reps and similar set of questions are asked among different services. This is scary. It's dangerous as having password stored in plain text as answers to the security questions can potentially unlock many other accounts. I highly suggest everyone answers each of them with a unique answe…

I use fake answers. Treat them as basically secondary passwords. I do keep them as real words though since sometimes they need to be answered over the phone and you don't want to read a long random string of characters.

Yeah, I used to use randomly generated strings until a customer service rep asked me to recite my security question answer to them... Now I use something like Diceware for real words.

Re: Password expiration is dead, long live passwords

#112

Post by bscphil »

mruts wrote: post #102
extra88 wrote: post #66

Earlier quoted context omitted.

*A common use-case for millionaires. FDIC limits are $250,000 per-institution, per-account owner, per-account type (CD, money market, savings, checking) and my understanding is joint accounts are considered separate owners so two spouses could have up to $750,000 in CDs at a single bank and be fully insured.

30% of households have an aggregate net worth above 250k. So the situation GP in describing is probably very common.

The portion of households that have $250k in the bank is no doubt much less than 30%.

Re: Password expiration is dead, long live passwords

#113

Post by bluedino »

CrowFly wrote: post #35
dessant wrote: post #24

That's exciting news, though it will take a couple of years until it trickles down to financial institutions. My bank forces me to change passwords every 3 months, and of course they also disable pasting for added security. We also have a local utility that sends you a 5 letter password upon account creation through email, and that's your password. If you try to change it, they'll send you another 5 letter one.

I have 2 and 3 year CDs in a bunch of banks. (This is a common use case, people open separate accounts because of the FDIC insurance limit in any one bank). I only need to log in again 2 or 3 years after opening the account to either take the money out, or open another CD. Some of these banks expire passwords every 6 months! That's insane. I have calendar reminders set to remind me to log in and generate another pass…

I think my credit union expires every 90 days :-/

Re: Password expiration is dead, long live passwords

#114

Post by dwaite »

matt_morgan wrote: post #103
EnderWT wrote: post #53

"Periodic password expiration is a defense only against the probability that a password (or hash) will be stolen during its validity interval and will be used by an unauthorized entity. If a password is never stolen, there’s no need to expire it. And if you have evidence that a password has been stolen, you would presumably act immediately rather than wait for expiration to fix the problem." Full post: https://blogs.…

This ignores the fact that most people use the same password everywhere, given the opportunity, and you have no idea what website has been breached. I.e. if you don't expire passwords, most people will use the same password everywhere, and you don't know when a compromise has happened, because it happened on some totally other network.

This doesn't need to be solved via time-based expiry though - you can use a breach list (like checking https://haveibeenpwned.com on registration,login, and password change).

Even an aggressive password change policy is typically one month since last change, which would give a long window for access.

Secondary factors, if at no other time then on first use of a machine, are also a good technique to prevent password breaches from spreading into your system.

Re: Password expiration is dead, long live passwords

#115

Post by bscphil »

omh wrote: post #25
jeremyjh wrote: post #17

Earlier quoted context omitted.

I came here to say this. I can't think of another way to guarantee that they aren't using the same password that they use on every website they've visited since 1997. If anyone has suggestions on this I'd love to hear it.

This is definitely a dilemma. If you're using Google Accounts then they have a feature for this[1]. It detects when they enter their Google password into any other site then reports it and makes them change their password. I'd love a similar feature that somehow worked with Active Directory. [1] Password Alert: https://support.google.com/a/answer/6197480

The requirements are actually using Google accounts, and requiring all your employees to use Chrome.

Re: Password expiration is dead, long live passwords

#116

Post by fastaguy88 »

SilasX wrote: post #68
Consultant32452 wrote: post #49

Earlier quoted context omitted.

I can't recommend e-banking enough. Through Fidelity you can purchase CDs from a number of banks across the country, shopping for the best interest rates. And you can create an auto-rolling CD ladder if that's your thing. I presume other e-banks like Schwab have similar features. Then you can manage all these things in one place, while getting the benefit of having your funds FDIC insured because they're technically…

I would think money market mutual funds are a more liquid, easier, higher yielding version of that. They don’t have the FDIC insurance, but they’re well diversified and invest in the highest grade of bonds, and “breaking the buck” (holding less than enough to redeem all deposits) is extremely rare.

From 2008 - ???, money market accounts were offering 0% interest, while CD's provided some small rate of return.

Re: Password expiration is dead, long live passwords

#118

Post by sverige »

mruts wrote: post #102
extra88 wrote: post #66

Earlier quoted context omitted.

*A common use-case for millionaires. FDIC limits are $250,000 per-institution, per-account owner, per-account type (CD, money market, savings, checking) and my understanding is joint accounts are considered separate owners so two spouses could have up to $750,000 in CDs at a single bank and be fully insured.

30% of households have an aggregate net worth above 250k. So the situation GP in describing is probably very common.

But the majority of that 30% with a net worth above $250k have most of it in the form of their house, not CDs.

Re: Password expiration is dead, long live passwords

#120

Post by kibwen »

bscphil wrote: post #105
jeremyjh wrote: post #17

Earlier quoted context omitted.

I came here to say this. I can't think of another way to guarantee that they aren't using the same password that they use on every website they've visited since 1997. If anyone has suggestions on this I'd love to hear it.

Some possibilities off the top of my head (some suggested here already): * Test for password strength (most reused passwords are weak) * Test for password existence in public databases (and recheck on database updates when they log in) * Automatically generate a secure password for your users at the account creation stage and require them to use it * Use a login method more sophisticated than just username / password…

> Test for password existence in public databases

While we're on the topic of security guidelines, this one really ought to be mandatory for any organization that cares about security in the slightest. It immediately invalidates the overwhelming majority of the class of laughably-insecure passwords selected by users.

Post reply on HN