Usually for work i create a password that looks something like this *01 and everytime you needed to change just bump up the number.
49% of workers, forced to change passwords, reuse same one with minor change
151–160 of 316 posts
Re: 49% of workers, forced to change passwords, reuse same one with minor change
#152I wouldn't rely on strong passwords generated from users.
I'd try to integrate a second factor like physical token like a yubikey or some otp code.
Re: 49% of workers, forced to change passwords, reuse same one with minor change
#153Earlier quoted context omitted.
Schneier says "don't make people change their passwords unless there's indication of compromise" I make the assumption that the longer a password exists, the more likely it's reused and compromised. I don't have insight into every password dump, but I know my users reuse passwords a lot. I think a long expiry is the best balance in my environment.
The point though is that if password changes are required, even with a long expiration time, people are only going to make minor and probably predictable changes to their password. If if you did a 1-year password expiration, and last year's passwords were compromised, then if the attacker figures out that someone's password last year was "uwethskjv9j29#18", then there's a good chance that the attacker is going to try…
Surely you gain more than nothing, even if it's not enough to justify the costs imposed on your users?
I often hear that attackers will simply increment the number at the end of your password, but users apply many different "simple" changes and it's likely that you'd need to try a fair few tries to guess correctly. That might be feasible if you have the new password hash or you're targeting an individual victim, but if you don't, then the password expiry policy offers some defence in depth.
Re: 49% of workers, forced to change passwords, reuse same one with minor change
#154The other fun requirements that tend to go hand in hand with forced rotation are max one change every day, and not repeating a previous password. But the repeating password buffer is usually small. When I still cared I would have [complexPassword], change it to [complexPassword]0, then for the next 10 days I'd change it [complexPassword]1..9, and on the 11th day I could change it back to [complexPassword] and be good for another few months.
Re: 49% of workers, forced to change passwords, reuse same one with minor change
#155I do this at my current job, character by character, as I'm asked to update it. I think I have a mix of four different slightly modified semi-unique passwords I've used in the past so far, so it's not great, but not terrible.
My password is currently 35+ characters, using upper and lower case letters, numbers, and punctuation, and is not shared with any other account I have. Even if someone were to get a list of other passwords I've used they would need to correctly guess what passwords I'm using here, what modifications I've made to them, what the order was, and where in the last password I've used I am, since I append a single character at a time.
I also try to go out of my way to use the weakest passwords possible for non-critical websites (eg subject specific forums) so if those are compromised the only thing someone gets is my username plus a really weak password as opposed to my username plus a relatively strong/unique password.
With that said, as I'm writing this, I acknowledge I should really start from scratch. It's better to be safe than sorry.
Re: 49% of workers, forced to change passwords, reuse same one with minor change
#156Earlier quoted context omitted.
It would be even cooler if I could open an app on my phone, point it at a QR code on screen, and not have anything else bother me
Would you sue me if I tried to implement this? That is a amazing idea.
do it. no one's going to sue for you implementing a random comment brainstorm.
Re: 49% of workers, forced to change passwords, reuse same one with minor change
#157I do this at my current job, character by character, as I'm asked to update it. I think I have a mix of four different slightly modified semi-unique passwords I've used in the past so far, so it's not great, but not terrible. My password is currently 35+ characters, using upper and lower case letters, numbers, and punctuation, and is not shared with any other account I have. Even if someone were to get a list of othe…
That's an interesting idea, yet seems unsustainable. How would you deal with typing such a long password on a mobile, for example?
Re: 49% of workers, forced to change passwords, reuse same one with minor change
#158The password requirements at my job are, in my opinion, insane. It has to be a specified length (an exact number of characters, no more, no less), can't contain any 3+ character words found in a dictionary, and a few other requirements like at least one capital letter and at least one number. And it has to change every three months. So yes, when I have to change my password I end up changing a single character or dig…
I've heard of banks setting a 8-character limit on password length. If my bank did that, I'd be searching for a new bank. Just just reeks of passwords being stored in plain text.
ING Australia [1] only supports a four-digit PIN. Seems to work fine for them; I haven't heard of anyone losing money as a result.
Re: 49% of workers, forced to change passwords, reuse same one with minor change
#159I do this at my current job, character by character, as I'm asked to update it. I think I have a mix of four different slightly modified semi-unique passwords I've used in the past so far, so it's not great, but not terrible. My password is currently 35+ characters, using upper and lower case letters, numbers, and punctuation, and is not shared with any other account I have. Even if someone were to get a list of othe…
That's an interesting idea, yet seems unsustainable. How would you deal with typing such a long password on a mobile, for example?
I'm not on mobile often anymore, but if I was it would be terrible and I would probably switch to something smaller or just use a keyboard (otg/usb? I'm not sure how secure bluetooth is).
Re: 49% of workers, forced to change passwords, reuse same one with minor change
#160Earlier quoted context omitted.
Notebook is a password manager
...which stores passwords in unencrypted plain text. (Admittedly, the database is behind a very strong network firewall.)
I don't remember where I read it, but someone advocated for writing down passwords because people are very accustomed to, and pretty decent at, keeping physical items safe.