Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

There’s no need to change passwords if they're robust, unique and not breached

tidbits.com

Post reply on HN
Print view View original

141–150 of 288 posts

Re: There’s no need to change passwords if they're robust, unique and not breached

#141

Post by e1g »

kelnage wrote: post #112
e1g wrote: post #28

In the USA, the latest government guidance from Jan 2022 is that "Password policies MUST NOT require use of special characters or regular rotation". [1] This is a strong upgrade from earlier softer language like "don't have to/should not". In practice, this new rule contradicts almost every InfoSec stance out there, but all government agencies must comply with this new rule by the end of the year, so expect lots of c…

> almost every InfoSec stance out there Except other national bodies like NCSC [1], and long-standing academic research e.g. [2, 3], that is! 1. https://www.ncsc.gov.uk/collection/passwords/updating-your-a... 2. https://dl.acm.org/doi/abs/10.1145/1866307.1866328 3. https://link.springer.com/article/10.1007/s10623-015-0071-9

In practice, when dealing with US auditors and infosec chiefs, saying that "Some researches/guidelines say X is not necessary" will not compel anyone to change because "This is always been this way, and it doesn't _hurt_". The conversation becomes categorically different if you say "The White House says X is not allowed anywhere."

Re: There’s no need to change passwords if they're robust, unique and not breached

#142

Post by sigstoat »

Darmody wrote: post #24
colinclerk wrote: post #7

Perhaps surprisingly, US government guidelines exist, are pretty fantastic, and agree with the author: Memorized secrets SHALL be at least 8 characters in length if chosen by the subscriber. Memorized secrets chosen randomly by the CSP or verifier SHALL be at least 6 characters in length and MAY be entirely numeric. If the CSP or verifier disallows a chosen memorized secret based on its appearance on a blacklist of c…

6 characters and entirely numeric seems like a bad idea, or am I missing something?

I interpreted it backwards, "if you want to use a numeric keypad for controlling access to something, the codes MUST be at least 6 digits long, and you MUST assign them"

Re: There’s no need to change passwords if they're robust, unique and not breached

#143

Post by mgerdts »

itvision wrote: post #109

I've been saying this for years. Whoever came up with the idea that passwords need to be regularly changed must be shot because no one has ever proved it makes any sense. What it actually does is that people write passwords everywhere (papers, text files, etc), thus actually lowering their security.

Passwords and password files are better protected now than they were 25+ years ago.

- ssh did not exist or was not widely used. People used telnet, ftp, rlogin, etc. which put plaintext passwords on the wire.

- UNIX systems that used NIS distributed the password file to clients via a plaintext map which could be obtained by anyone with “ypcat passwd”. Many passwords were guessed in seconds using crack or John the ripper. Complex passwords would withstand those attacks for weeks or months with those tools using a single computer to reverse them.

- (I think) NTLM and CIFS authentication put password hashes over the wire. Various tools were available to reverse these as well. Once it was feasible to build rainbow tables, getting a password from a hash was a simple lookup.

- switched networks were not widely used making sniffing passwords or hashes from the wire much easier. Hubs would broadcast all traffic from all ports to the other ports on the hub. Coaxial Ethernet daisy chained many computers along the same physical wire. I think that “ring” networks (token ring, fddi) also passed all traffic by all nodes.

In those days, regular password changes were important because your password it it’s hash was regularly exposed.

I’d argue that today, any password you type where someone else may have a camera should be treated as though it has also been compromised. This means that if your password manager isn’t auto filling it, you should be using that password only with two factor authentication.

(edit: formatting, auto-carrot)

Re: There’s no need to change passwords if they're robust, unique and not breached

#144

Post by splitstud »

civilized wrote: post #52
ejb999 wrote: post #20

I am in the camp of requiring people to have strong passwords, and not requiring them to be changed - ever. When you ask people to remember too many passwords, they start writing them down and/or forgetting them, which leads to other problems. My oldest online account - btw it is a brokerage account at one of the big brokerage houses, where a great deal of my cash and investments sit - has not asked me to change the…

Writing passwords down is inevitable. Having to remember more than two truly strong passwords is a ridiculous requirement to impose on the general population, and we live in a world where we need access to dozens of different accounts which ideally are supposed to all have different passwords. We either need password managers or we need to do away with passwords entirely.

No post body was provided.

Re: There’s no need to change passwords if they're robust, unique and not breached

#146

Post by pkulak »

Darmody wrote: post #24
colinclerk wrote: post #7

Perhaps surprisingly, US government guidelines exist, are pretty fantastic, and agree with the author: Memorized secrets SHALL be at least 8 characters in length if chosen by the subscriber. Memorized secrets chosen randomly by the CSP or verifier SHALL be at least 6 characters in length and MAY be entirely numeric. If the CSP or verifier disallows a chosen memorized secret based on its appearance on a blacklist of c…

6 characters and entirely numeric seems like a bad idea, or am I missing something?

It's fine if there's no way an attacker can execute a brute-force attack. And that can even be prevented in hardware. The iPhone is a good example.

Re: There’s no need to change passwords if they're robust, unique and not breached

#147

Post by borplk »

There is still a specific case for password rotation which is to periodically rule out the threat of compromised passwords.

Meaning, if your password is 10 years old it's subject to any leaks or security events during that long time frame. If it's 3 months old, anything that could have happened to it must have happened in the last 3 months which is much better than 10 years.

Re: There’s no need to change passwords if they're robust, unique and not breached

#148

Post by teknopaul »

One thing people seem to forget is that if passwords are long and too complicated to be remembered then thave to be written down somewhere, a password manager is all your eggs in one basket. Lose access to your password manager and you can't access any online accounts with unrememberable passwords. Depending on the use case, a rememberable password is often a better option. One you can easily type on a phone is often a priority. My WiFi passwords are long lowercase no spaces word combinations, that are grammatically incorrect. Easy to remember and type on phones or WiFi printers. Most websites won't allow that.

I find sites that ignore my opinion on password security annoying. Some sites I just don't use because of their password policy.

Post reply on HN