> There’s no need to change passwords if they're robust, unique and not breached This assumes you'll know if passwords were exposed in a breach. Some breaches go undetected.
It's honestly strange this has to be said as it's such an obvious thing.
There’s no need to change passwords if they're robust, unique and not breached
121–130 of 288 posts
Re: There’s no need to change passwords if they're robust, unique and not breached
#122Earlier quoted context omitted.
The "character class" requirement really doesn't add much security. And the "password rotation" policy can actually result in worse passwords than otherwise. Those measures were effectively just folk medicine from the days when the threat was thought to be someone manually trying to brute-force your password at your terminal.
> can actually result in worse passwords than otherwise Does actually. I still require some of the password "rotation" schemes folks would use when we were forced to change them monthly (not a typo, sadly): 1qaz2wsx -> 2wsx3edc -> 3edc4rfv... Pass1word -> Pass2word -> Pass3word...
“February, 2022”
Upper case, lower case, digit, special character, does not match any previous password, changeable monthly without having to write it down…
Re: There’s no need to change passwords if they're robust, unique and not breached
#123I feel like this post was intended to inflame or shock the reader with the writers stance on password policy. But anyone who has been in security for more than 1 month knows that regular password rotation has not been a recommendation for over 5 years. Both NIST, and MS have been trying to get the world to move to long, never rotated password, so long as those passwords are dictionary checked.
Every company (all 3 of them) I have worked at within the last 10 years, the IAM team has already implimented, or was working on implimenting a system that removed regular rotation, special chars and number requirements, and relied on three things: Length, a dictionary check at the time of pass creation, and routine dictionary attacks against the credential store. This started 10 years ago, for someone to make the same claims now, is not a shock.
Please note that if you are unable to impliment such an IAM system, especially the inability to dictionary check the credentials against known lists (seclists' github is great for this), then length plus regular rotation is still the recommendation
Re: There’s no need to change passwords if they're robust, unique and not breached
#124One missed point, the advice is even slightly better than they argue, since they only argue that it's not necessary to change it, which is just an argument of convenience. But updating a password is itself an attack surface. More so than merely using it to log in. It's one of the times where an attacker may be tricking you into giving it to them, either by a fake page or app dialog, or in concert with maybe they have…
Agreed. I think the main new vector is a "new device". So having the user approve on an old device (where possible or otherwise use 2FA) would prevent most of the log in attacks. It also removes the attack of "look under the mouse pad" where bribing a cleaning person gets you a whole company's user logins.
Re: There’s no need to change passwords if they're robust, unique and not breached
#125Earlier quoted context omitted.
> When you ask people to remember too many passwords, they start writing them down and/or forgetting them, which leads to other problems. Writing passwords down isn't the worst thing. If you can't convince someone to use a password manager like 1Password, getting them to use a physical notebook of unique and strong passwords is actually the next best thing, because (combined with 2FA) it protects them against the mos…
A business card stored in a wallet or purse is pretty good too. After all, we're already pretty used to protecting our credit cards, identity cards, and cash.
It's pretty bad to put both a debit card and it's password together.
The only reason it's even tolerable risk to walk around out in the wide random world with a debit or credit card on your person all day every day, is because somewhere else you have the means to disable it and declare it lost.
This is like storing the keys to your car conveniently right on your car.
Re: There’s no need to change passwords if they're robust, unique and not breached
#126For people who have to change their password regularly I suggest just adding the month and year in numbers at the end of whatever password they like to use. That way there is a clue in the current month and year as to what their password probably is should they forget
If a hacker found an old password of yours, the month an year would be a pretty easy indictor of what to try next, right?
My security policy is based on the most common data breaches, where an adversary obtains a big list of email/passwords and just tries them on a handful of sites (Facebook, Twitter, etc), throwing out the records that don't work.
Sure, it's technically possible to decipher the algorithm[0] I use to generate new passwords, but that's not what I'm protecting against. If someone is trying to attack a specific person, there are much more effective ways[1].
[0]: For example, if my password for HN is "1y2c3o4m5b!$", you could sit down and figure out my reddit password.
[1]: https://gizmodo.com/how-i-lost-my-50-000-twitter-username-15...
Re: There’s no need to change passwords if they're robust, unique and not breached
#127Earlier quoted context omitted.
With a ratelimit of 60 attempts per minute (which is significantly higher than any user would legitimately ever need) you're looking at thousands of years to bruteforce a random 6 character alphanumeric password.
This seems remarkably unintuitive, but the math checks out. (26+10)⁶ = 2,176,782,336 1,450 minutes a day 2,176,782,336 / (1,450 * 60) = ~25,000 years
You went from min per day multiplied by constant per min and ended up with years somehow.
Re: There’s no need to change passwords if they're robust, unique and not breached
#128What about an undetected data breach leaking username and passwords? Periodic password replacement reduces the window where someone's stolen password is used a long time after breach. This may not be the threat scenario for every type of accounts, but in some type it would one among the most important ones.
If it remains undetected, the rotated passwords will still be leaking. Once you detect and mitigate it, you force everyone to reset their password immediately. Periodic password rotation is pointless.
Re: There’s no need to change passwords if they're robust, unique and not breached
#129> Robust, unique and not breached
What? If they're not breached then that invalidates the other two points anyway - unless you can find an authentication endpoint that doesn't rate limit. HTTP proxies are expensive and trying to brute force something that is on-server is not a common attack vector.
I know its nit-picking, but the title is incendiary and warrants that.
Re: There’s no need to change passwords if they're robust, unique and not breached
#130Earlier quoted context omitted.
> Is perfectly fine, but often is not allowed Nor is "correct horse battery staple". For wanting symbols, so many password systems really hate spaces.
correct horse battery staple is a terrible password :D
Check out the reference here: https://xkcd.com/936/