Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password expiration is dead, long live passwords

techcrunch.com

Post reply on HN
Print view View original

131–140 of 316 posts

Re: Password expiration is dead, long live passwords

#131

Post by daveFNbuck »

sriku wrote: post #123
paulryanrogers wrote: post #43

Earlier quoted context omitted.

Some never memorize their passwords at all. Instead relying on 'forgot' emails and "Remember Me" features entirely.

It is one way to go "passwordless" .. though you're piggy backing on the security that your email system already has. Shameless plug of old post that describes how to restrict login to only the initiator even if login is initiated via an email link - http://sriku.org/blog/2017/04/29/forget-password/

You're relying on your email security either way, since anyone can trigger the password reset email if they get access to your email account.

Re: Password expiration is dead, long live passwords

#132

Post by cortesoft »

dessant wrote: post #24

That's exciting news, though it will take a couple of years until it trickles down to financial institutions. My bank forces me to change passwords every 3 months, and of course they also disable pasting for added security. We also have a local utility that sends you a 5 letter password upon account creation through email, and that's your password. If you try to change it, they'll send you another 5 letter one.

PCI certification requires passwords to be rotated every 90 days.

Re: Password expiration is dead, long live passwords

#133

Post by infogulch »

pstch wrote: post #63
rtempaccount1 wrote: post #38

Earlier quoted context omitted.

TOTP or other forms of 2FA are the best way of avoiding the very real problem of user password re-use.

I don't see how TOTP/2FA can avoid the problem of user password re-use. The password has still been reused, whether an extra layer of authentication is used or not. Maybe you can say that it mitigates it, but I don't think it avoids it at all.

There are two slightly overlapping ways to actually solve this problem: 1. Use a password manager. 2. Have the tools, knowledge, capability, and willingness to use secure passphrases.

Re: Password expiration is dead, long live passwords

#134

Post by nitwit005 »

paulryanrogers wrote: post #43
omh wrote: post #36

Earlier quoted context omitted.

Unfortunately we still have to have similar authentication methods for other password resets. Users have an alarming tendency to forget their passwords after a week or two of holiday.

Some never memorize their passwords at all. Instead relying on 'forgot' emails and "Remember Me" features entirely.

I have wondered if some web pages effectively have this as the main log in method. If you have a hurricane tracking page, everyone is going to forget their passwords in between hurricane seasons.

Re: Password expiration is dead, long live passwords

#135

Post by idle_zealot »

x3ro wrote: post #124
donatzsky wrote: post #81

Earlier quoted context omitted.

There's an extension called Don't Fuck With Paste, which is a better solution.

Can you explain why this is better than changing the configuration?

Presumably because the config option disables all access to paste events and this access is sometimes desirable.

Re: Password expiration is dead, long live passwords

#136

Post by killjoywashere »

antoineMoPa wrote: post #30
dessant wrote: post #24

That's exciting news, though it will take a couple of years until it trickles down to financial institutions. My bank forces me to change passwords every 3 months, and of course they also disable pasting for added security. We also have a local utility that sends you a 5 letter password upon account creation through email, and that's your password. If you try to change it, they'll send you another 5 letter one.

Bank programmers live at least 5 years in the past.

Military programmers live 20 years in the past because the contracting system forces them too. The contracting people live in 1970. The actual flag officers in charge live like it's 1955.

Re: Password expiration is dead, long live passwords

#137

Post by rconti »

davemp wrote: post #2

I've always wondered how many engineer hours have been lost on the phone with helpdesks sorting out expired passwords.

My favorite one was when I supported a customer who expired our passwords every 60 days, and resetting it involved calling Sweden (from the US) between roughly 10:30pm and 7am Pacific. Needless to say, of the 40 or so people who should have been doing this, few of them were.

And that was just one of a dozen or two customers with varied policies requiring we turn over SSNs, carry SecurID tokens, install various soft tokens on our laptops, roll passwords every so often, go through various and sundry jump hosts, etc......

Re: Password expiration is dead, long live passwords

#138

Post by mamon »

tzs wrote: post #52
LeoPanthera wrote: post #20

Earlier quoted context omitted.

I briefly worked at a place that enforced quarterly password changes and I literally used as my password. I am not good at remembering passwords and I don't think I'm that unusual. Writing them down seemed worse than using a poor password that I can at least remember. Probably these days if forced I would use . I don't know how much better that is. But luckily now I work for myself.

How often have you had information stolen off a credit card, passport, driver's license, insurance card, or other item with sensitive information printed on it that you routinely carry around in your wallet? For most people, the answer is "never". We are actually quite good at safely keeping secrets on paper in our wallets, and so generally writing down a password and keeping it there is fine, especially if the choic…

Plus, people usually have a better memory that they give themselves credit for. With reasonably short random password (say, 10-12 chars, uppercase, lowercase, digits) that you use often, you will memorize it after a week, at which point you can simply destroy post-it note you carried in your wallet.

Re: Password expiration is dead, long live passwords

#139

Post by checkyoursudo »

bscphil wrote: post #107
Someone1234 wrote: post #93

Earlier quoted context omitted.

I used to also, until this blew up in my face. Put random stuff as the security answers in my Trial World of Warcraft account in 2005. In order to merge it into my Battle.net 2.0 account around 2009 I needed to know it, and even though I had the correct password there was no way to change security questions and I had to beg customer support (which was a long process, involving software serial numbers, scans of ID, th…

I assume when people suggest putting random strings in these fields, it's implied that you're supposed to save that data in a password manager or something. Mine (KeePassXC) supports storing arbitrary data as "notes" in each entry, along with TOTP information (great as a backup in case you lose your phone), and other stuff. I worry more that a particularly dull customer support agent is likely to be convinced by a ra…

This is what I do, although like others mention I still use real words. I add my bogus answers to security questions as notes in my password manager. This method has worked well for me for a long time without any risk that I have discovered.

Re: Password expiration is dead, long live passwords

#140

Post by brigandish »

nitwit005 wrote: post #134
paulryanrogers wrote: post #43

Earlier quoted context omitted.

Some never memorize their passwords at all. Instead relying on 'forgot' emails and "Remember Me" features entirely.

I have wondered if some web pages effectively have this as the main log in method. If you have a hurricane tracking page, everyone is going to forget their passwords in between hurricane seasons.

I wondered about this too and asked about it on the security stackexchange forum in case I was overlooking some glaringly obvious reason not to. Turns out that most thought it was reasonable too, though maybe too frustrating for some.

https://security.stackexchange.com/q/12828/8518

Post reply on HN