I am not convinced and I'll continue to rotate my passwords on a periodical basis.
And that’s fine. It should be your choice to do this, rather than being forced to.
Password expiration is dead, long live passwords
151–160 of 316 posts
Re: Password expiration is dead, long live passwords
#152That's exciting news, though it will take a couple of years until it trickles down to financial institutions. My bank forces me to change passwords every 3 months, and of course they also disable pasting for added security. We also have a local utility that sends you a 5 letter password upon account creation through email, and that's your password. If you try to change it, they'll send you another 5 letter one.
PCI certification requires passwords to be rotated every 90 days.
Now that NIST is on board with long lived passwords, I really hope the next iteration of PCI follows suit.
Re: Password expiration is dead, long live passwords
#153Earlier quoted context omitted.
Some never memorize their passwords at all. Instead relying on 'forgot' emails and "Remember Me" features entirely.
I have wondered if some web pages effectively have this as the main log in method. If you have a hurricane tracking page, everyone is going to forget their passwords in between hurricane seasons.
Bulb energy supplier in the UK trialled this - they soon switched due to complaints although I didn't really mind it.
Assume it was due to the inconvenience of not being able to remember password/stay signed in.
Re: Password expiration is dead, long live passwords
#154Surprisingly, the most important organizations (like banks and government departments who have critical data) who need to ditch this practice, embrace it like the holy grail.
Re: Password expiration is dead, long live passwords
#155Earlier quoted context omitted.
Some never memorize their passwords at all. Instead relying on 'forgot' emails and "Remember Me" features entirely.
I have wondered if some web pages effectively have this as the main log in method. If you have a hurricane tracking page, everyone is going to forget their passwords in between hurricane seasons.
Steam has nearly done this for me.
Oh, it has a password. But if I remember my password I have to check my email and copy and paste a code from there. And if I forget my password I have to... check my email and copy and paste a code from there... really not much point to the password.
Re: Password expiration is dead, long live passwords
#156Earlier quoted context omitted.
Unfortunately we still have to have similar authentication methods for other password resets. Users have an alarming tendency to forget their passwords after a week or two of holiday.
Some never memorize their passwords at all. Instead relying on 'forgot' emails and "Remember Me" features entirely.
Indeed. On sites I have to register but know I won't go frequently I enter a random password I don't even write down, relying on the Forgot password feature if I ever need to come back later.
Re: Password expiration is dead, long live passwords
#157Earlier quoted context omitted.
I disagree. I feel it's not a site's responsibility to stop users from reusing their passwords if they choose to. It has no relation to the security of the service. As a metaphor, a good lock maker protects their customers from lock picking, not from a key left under the mat. Personally, I reuse a simple password for very non-important services and it's very convenient. I think that's ok, or at the very least I shoul…
I've never heard of a website implementing something like this. Password rotation requirements are usually found in corporate or government settings, for logging into your workstation, email and internal applications.
"internal" and line of business apps are not provided as cloud hosted SaaS yet?
I work on a web based SaaS used mainly by different parts of the government and we are often asked about password policies and rotation, to which we point at the nist & nscs advice
Re: Password expiration is dead, long live passwords
#158This should be coupled with the usage of multi-factor authentication and making users aware of when and where their accounts have been used.
In organizations, one issue is users knowingly sharing their accounts with fellow workers. It's not because they don't know better, but because this is more convenient. Forced password changes (with limits on password re-use) can limit the risks caused by this.
Re: Password expiration is dead, long live passwords
#159Recent, frustrating example: My (business) bank uses FISERV software, and their software expires passwords every 90 days. Their software can notify you about a million combinations of account activities and statuses, except this one. It takes 3 values to login to the account (company ID, username, password). When logging in via mobile app, it never tells you that your password has expired, so I end up trying a few ti…
The problem with having a short expiration is that it forces people to simply use their password with a count: password1, password2, ... password23, password24. This means that if you discover someone's current password, you also have their future 10+ passwords as well.
I would think anyone enforcing password expiration would make sure the password is sufficiently (subjective) different from current password. This should be simple to enforce by asking for current password when you are asking for new password. You can perform a text match before computing whatever hash you need to store.
Re: Password expiration is dead, long live passwords
#160Earlier quoted context omitted.
Unfortunately we still have to have similar authentication methods for other password resets. Users have an alarming tendency to forget their passwords after a week or two of holiday.
Some never memorize their passwords at all. Instead relying on 'forgot' emails and "Remember Me" features entirely.
In India, most mobile apps have phone number for username and OTP instead of password. Makes perfect sense for mobile apps. Except when OTP doesn't arrive due to congested sms networks. Or that your account gets hacked with sim takeover or sms MitM (both are currently unheard of in India).