Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

There’s no need to change passwords if they're robust, unique and not breached

tidbits.com

Post reply on HN
Print view View original

111–120 of 288 posts

Re: There’s no need to change passwords if they're robust, unique and not breached

#111

Post by hadlock »

Darmody wrote: post #24
colinclerk wrote: post #7

Perhaps surprisingly, US government guidelines exist, are pretty fantastic, and agree with the author: Memorized secrets SHALL be at least 8 characters in length if chosen by the subscriber. Memorized secrets chosen randomly by the CSP or verifier SHALL be at least 6 characters in length and MAY be entirely numeric. If the CSP or verifier disallows a chosen memorized secret based on its appearance on a blacklist of c…

6 characters and entirely numeric seems like a bad idea, or am I missing something?

Re: entirely numeric, as long as the attacker assumes that the victim may use letters in their password, all numbers is fine, it increases the total number of possible combinations an attacker needs to work through

Re: There’s no need to change passwords if they're robust, unique and not breached

#112

Post by kelnage »

e1g wrote: post #28

In the USA, the latest government guidance from Jan 2022 is that "Password policies MUST NOT require use of special characters or regular rotation". [1] This is a strong upgrade from earlier softer language like "don't have to/should not". In practice, this new rule contradicts almost every InfoSec stance out there, but all government agencies must comply with this new rule by the end of the year, so expect lots of c…

> almost every InfoSec stance out there

Except other national bodies like NCSC [1], and long-standing academic research e.g. [2, 3], that is!

1. https://www.ncsc.gov.uk/collection/passwords/updating-your-a...

2. https://dl.acm.org/doi/abs/10.1145/1866307.1866328

3. https://link.springer.com/article/10.1007/s10623-015-0071-9

Re: There’s no need to change passwords if they're robust, unique and not breached

#113

Post by UltraViolence »

pkilgore wrote: post #98
UltraViolence wrote: post #44

I use Password Safe, an open-source password database. I highly recommend it for people that are more computer savvy. For the digital illiterates OnePass may be more suitable.

"digital illiterates" is quite a take there when any password manager is involved.

That's why Firefox added password generation on my request.

I'm the person that you should thank for that, I believe.

Re: There’s no need to change passwords if they're robust, unique and not breached

#114

Post by clsec »

ReactiveJelly wrote: post #65
adam0c wrote: post #51

#PREACH! the Hive infograpgh (amongst others) always comes to mind; 18 characters long, upper, lower, numerical, special. estimate time to brute force 438tn years.

How many years to memorize and type 18 random characters?

not OP but I only have to remember two 18 character passwords, my laptop and KeepassXC. I use all of OP's suggestions as well as mixing languages, one being an indigenous language that only about 20K people in the world know, together with a little leet speak. I haven't been breached since the early 2000's.

Re: There’s no need to change passwords if they're robust, unique and not breached

#115

Post by Karsteski »

Moodles wrote: post #37

A lot of users will simply change their passwords by appending a 1, 2, 3, etc. at the end. Presumably if old passwords did sour and become compromised then Hashcat would easily crack the minor tweak on the new password. To be fair to these companies, the reason they do passwords so terribly is because of such poor guidance and standards in the past. Even now NIST has SP 800-132 for guidance on generating a cryptograp…

This is literally what I did at my last company, where we had to change our passwords every few weeks. It was so damn frustrating. I'd be fine memorizing a random string of text, but having to constantly change my passwords meant that I'd continuously get locked out until I did that.

For my own personal use, I just use a password manager + randomly generated passwords, but it seems corporations are so damn slow to pick up on these obviously beneficial things that they choose clearly antiquated standards instead.

Re: There’s no need to change passwords if they're robust, unique and not breached

#116

Post by detinho »

Brian_K_White wrote: post #97

One missed point, the advice is even slightly better than they argue, since they only argue that it's not necessary to change it, which is just an argument of convenience. But updating a password is itself an attack surface. More so than merely using it to log in. It's one of the times where an attacker may be tricking you into giving it to them, either by a fake page or app dialog, or in concert with maybe they have…

Indeed. Recently my wife updated her google account password thinking she was updating the password from the game she wanted to play.

She only knew because I'm on the recovery password list and as soon I received the email from Google asked her to confirm.

Re: There’s no need to change passwords if they're robust, unique and not breached

#117

Post by dylan604 »

thejerz wrote: post #100

> There’s no need to change passwords if they're robust, unique and not breached This assumes you'll know if passwords were exposed in a breach. Some breaches go undetected.

Another comment that reads as if they are skipping the "unique" part of the text they are quoting.

If you use unique passwords for everything and a leak goes undetected, the damage is contained to just that one site/service.

cherry picking quotes to nitpick is only effective if you address the full quote rather than cherry picking a point of a cherry picked quote

Re: There’s no need to change passwords if they're robust, unique and not breached

#118

Post by cies »

> not breached

Which a consumer of a service does not know. There's law now to force providers of services to announce leaks/breaches and there's haveibeenpwned; both are no guarantee.

Changing a password gives consumers a fresh start.

> Passwords do not age. They do not sour, spoil, or stale.

The "fresh start" does imply some sort of spoiling/ageing.

Rotating passwords (re-freshing) in the age of password managers is not that much work, for some critical accounts that may be a good thing.

Re: There’s no need to change passwords if they're robust, unique and not breached

#119

Post by cromd »

dylan604 wrote: post #93
cromd wrote: post #81

Worth keeping in mind that passwords do actually leak. Companies have had incidents where they were inadvertently logging secrets passed to them. I've also typed/pasted secrets in the wrong field, which can get into some database or user-interface tracking tool. I've typed my sudo password instead of a vpn password at the command line, thinking sudo login had triggered when it was instead cached. Who knows when these…

If you do not reuse passwords and one of them does leak, then the only thing affected is the site/service that was compromised. Hence the word "unique" in the title.

That is true, but that one secret is still at risk, and maybe that secret means the world to you. You don't know when the info will be discovered or change hands. "No need to change" could maybe be nitpicked even though I agree with it in general - changing seems to provide some marginal probabilistic benefit if done properly, and the cost/benefit probably depends on what you are protecting.

Re: There’s no need to change passwords if they're robust, unique and not breached

#120

Post by tinalumfoil »

You won't necessarily know about every leak. If a security camera records you typing in your password (or you accidentally hit view password in your manager) today someone might find that recording and access your account two years from now. Resetting your password resets the buildup of these small information leaks that occur over time.

Best practices get better over time. Maybe two years ago that password was stored as an MD5 hash, and that hash was getting leaked to log data. Bank.com has since fixed that problem, but you don't get the benefit unless you change your password.

Post reply on HN