Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

49% of workers, forced to change passwords, reuse same one with minor change

grahamcluley.com

Post reply on HN
Print view View original

141–150 of 316 posts

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#141

Post by crankylinuxuser »

hwbehrens wrote: post #7

This should not be a surprise, as this supports the NIST's revised recommendations (from June 2017!) that passwords should not expire [0], because it actually leads to less-secure passwords for this exact reason. Furthermore, many corporate systems do not integrate well with password managers, such as when first logging in to your system in the morning. This means that the password is likely to be one of the few that…

So I was going to ask a variant on that question...

How many businesses do you know follow NIST's new password guidelines?

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#142

Post by _ah »

obelos wrote: post #123

I used to have to deal with an enterprise system that required quarterly password changes. The interesting thing about this system was it would refuse to let you set a new password that wasn't sufficiently different from the previous several passwords... Which almost certainly means they were implementing this security measure by storing the passwords in plaintext on the server.

You could take the first N characters of the password and store that as a secure hash. That would catch people choosing password1, password2, etc (but wouldn't help much with 1password, 2password...)

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#143

Post by the8472 »

asveikau wrote: post #139
peteretep wrote: post #103

Earlier quoted context omitted.

It would be even cooler if I could open an app on my phone, point it at a QR code on screen, and not have anything else bother me

Make sure nobody takes a photo of you showing your qr code I guess.

The QR code would only contain a login challenge, the phone would complete the challenge. Of course that would mean the auth server must be publicly reachable or the phone must be in the same network.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#144

Post by jerf »

Insanity wrote: post #82
jerf wrote: post #51

Earlier quoted context omitted.

Zaphod Beeblebrox's kite harasses Tuscon. Great, one more collapsing home. Why? 7 termites risk 5 bad days. Knight's queen kills narcs; Good Game queen. Fighting inside futons upends Greater Detroit in 7. But that's because you forced the choice on me, and I'm only willing to work so hard for a Hacker News post. Ideally, you turn it into one coherent story. If I can choose my password, and I usually can after all: Za…

How fast can you enter that password? Like, is it a reasonable time or are you basically pecking at your keys?

I don't actually use 35-char passwords. That was just to answer the challenge. Mine are more on the order of 20.

It's fairly fast, actually. One of the things I've decided to do is trade some entropy for having only lower case letters and the minimum symbol count, because what tended to screw me up most was synchronizing the shift key with the rest of the password... which I suppose also gives a clue about the speed. It's at least no slower than a passphrase of equivalent strength, and it fits my brain.

But if passphrases work better for you, by all means, please do.

Also, I have a password manager. I only have about 4 of these at any given time, and I can afford the cognitive burden of ensuring they are all very strong. It'd be a different problem otherwise.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#145

Post by denimnerd42 »

fluidcruft wrote: post #102
nickthegreek wrote: post #55

Earlier quoted context omitted.

I access my manager from my phone and type them in. I would never install my LastPass on a public computer even if they let me.

It would be really cool if you could plug your phone in and it appeared as a USB keyboard device and you could "type" the password from the password manager that way without ever giving the computer access to anything except that password. Maybe some sort of simple USB dongle (like a yubikey) could be fed by the phone via bluetooth or nfc to do this?

you can use a teensy. i have a prototype that communicates to a teensy over serial connection and types in a pw from an app. could use wifi or bluetooth too.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#146

Post by caconym_ »

I did this at my old job where they forced regular PW changes. The thing that changed was the string of digits at the end, which was always the year and month I was last forced to change it.

Of course, for my personal logins I use a manager and unique strong passwords, but they gave me no reason to care about password security and a bunch of reasons not to.

Honestly I'm surprised it's as low as 49%.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#147

Post by sjy »

Wowfunhappy wrote: post #65
hwbehrens wrote: post #7

This should not be a surprise, as this supports the NIST's revised recommendations (from June 2017!) that passwords should not expire [0], because it actually leads to less-secure passwords for this exact reason. Furthermore, many corporate systems do not integrate well with password managers, such as when first logging in to your system in the morning. This means that the password is likely to be one of the few that…

> Furthermore, many corporate systems do not integrate well with password managers, such as when first logging in to your system in the morning. ...are there any desktop OS's which do integrate well with password managers, for your login password? By definition, you can't open the password manager until you've logged into the machine. So you'd need to open the password manager on a separate device. The one exception…

I think it's possible to use your FDE key to decrypt the filesystem, autologin to the desktop, unlock GNOME Keyring or a similar keychain application, and use that as a GPG and SSH agent to further encrypt your passwords using pass [1]. Since it's just Git and PGP, there are pass implementations for most OSes. I'm not sure if that counts as "integrating well;" it certainly doesn't work out of the box. I'm using all these components individually, but still typing my password 100 times a day for now.

[1]: https://www.passwordstore.org/

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#148

Post by Dylan16807 »

akira2501 wrote: post #97
jerf wrote: post #51

Earlier quoted context omitted.

Zaphod Beeblebrox's kite harasses Tuscon. Great, one more collapsing home. Why? 7 termites risk 5 bad days. Knight's queen kills narcs; Good Game queen. Fighting inside futons upends Greater Detroit in 7. But that's because you forced the choice on me, and I'm only willing to work so hard for a Hacker News post. Ideally, you turn it into one coherent story. If I can choose my password, and I usually can after all: Za…

To me, there's an irony in that "Zaphod Beeblebrox's kite harasses Tuscon." is not only _more_ memorable on it's own, but is probably a _better_ password than "ZBw3hHg1tFWdhdt?Hoh2hXcrZmn" Stop using passwords, just use a "pass sentence." My last few passwords at my previous employer: "Tim, bring me chicken #15" "Mary, stop looking at me!" "Nothing you can do about 2!" "The coffee here is gross." Seriously.

There's absolutely no way a five word password is better than 32 random characters. Two plain old random words, the entropy of that is less than 16 bits each, but we'll round up. One of the biggest cities in the US is probably even less useful, but let's credit it for 16 bits. And let's rate Zaphod Beeblebrox as one-in-a-million for entropy purposes.

That's 68 bits. It's somewhere between 11 and 12 random alphanumeric characters. It's unimaginably weaker than 32 random characters.

A random word is generally worth about 2 to 2.5 random characters. Sometimes that's easier to remember, sometimes it isn't.

And your example passwords are not that strong. A simple algorithm picking words just by rarity could hit "The coffee here is gross." within about 2^50 iterations, and a single consumer GPU can test about 2^48 - 2^52 hashes per day. "the", "here", and "is" are way too common. You only have two moderately random words.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#149

Post by _-david-_ »

discreditable wrote: post #28
hwbehrens wrote: post #7

This should not be a surprise, as this supports the NIST's revised recommendations (from June 2017!) that passwords should not expire [0], because it actually leads to less-secure passwords for this exact reason. Furthermore, many corporate systems do not integrate well with password managers, such as when first logging in to your system in the morning. This means that the password is likely to be one of the few that…

My argument for password expiry (300 days here) is my users have complained they can't keep using the password they use everywhere else.

They can change all their passwords every time one requires a change password.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#150

Post by Jach »

vlunkr wrote: post #94
teekert wrote: post #70

Of course we do. My password manager does not work for the Windows login and I need to change it every 3 months. I can remember 1 large complicate pass-sentence, but not a different one every three months.

For cases like these I semi-seriously suggest using a keyboard with programmable macros. Usually people laugh it off but I think it's not the worst idea. Almost no one I know would know how to find and execute a macro on my keyboard, if they even considered looking for a password there.

I may have done this at an employer. You don't need a keyboard with programmable macros, though, just a way in the OS to setup a keyboard shortcut to run a command. In Linux it's super easy to make "super + x", or other modifiers + key, execute a bash program. That bash program can then use xdotools to type a password, generated and type a 2FA token, type a ¯\_(ツ)_/¯ string (because slack imagified the emoji version making it unreadable), whatever...
Post reply on HN