Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

There’s no need to change passwords if they're robust, unique and not breached

tidbits.com

Post reply on HN
Print view View original

151–160 of 288 posts

Re: There’s no need to change passwords if they're robust, unique and not breached

#151

Post by MattGaiser »

Beached wrote: post #123

I feel like this post was intended to inflame or shock the reader with the writers stance on password policy. But anyone who has been in security for more than 1 month knows that regular password rotation has not been a recommendation for over 5 years. Both NIST, and MS have been trying to get the world to move to long, never rotated password, so long as those passwords are dictionary checked. Every company (all 3 of…

Most orgs I have worked for have had/have 90 day password rotation. It resulted in passwords being stored in a Teams channel for easy access in case you did not remember.

Re: There’s no need to change passwords if they're robust, unique and not breached

#152

Post by Spivak »

sdoering wrote: post #131
Beached wrote: post #123

I feel like this post was intended to inflame or shock the reader with the writers stance on password policy. But anyone who has been in security for more than 1 month knows that regular password rotation has not been a recommendation for over 5 years. Both NIST, and MS have been trying to get the world to move to long, never rotated password, so long as those passwords are dictionary checked. Every company (all 3 of…

Working at a acquisition of a big consulting corporation. Had these recommendations in place before being acquired. We're onboarded onto better security systems by new mothership. Password rotation every 75 days. No dictionary check. No check against known breached passwords. No real reasonable rules against insecure passwords (like ac_Paul2022 is valid 'secure' password). Additional massive "spyware" on corporate de…

I think my cynical take is to not actually care. Very few people in the whole security industry actually bother to care because it's mostly box checking regulatory requirements and/or certifications because security beyond the absolute minimum just isn't important to the job. Most places aren't being attacked or broken into, and in the slim chance it happens there's less money to say "sorry for being breached, we're $worthless_cert compliant, nothing else we could do" because customers will believe it.

Re: There’s no need to change passwords if they're robust, unique and not breached

#153

Post by xondono »

Lamad123 wrote: post #137
Beached wrote: post #123

I feel like this post was intended to inflame or shock the reader with the writers stance on password policy. But anyone who has been in security for more than 1 month knows that regular password rotation has not been a recommendation for over 5 years. Both NIST, and MS have been trying to get the world to move to long, never rotated password, so long as those passwords are dictionary checked. Every company (all 3 of…

Special characters are OK.. The casual layperson knows how to make a special character a separator.

Special character requirements normally end with most people adding # to the end of their dictionary vulnerable password, plus a lot more of valid password reset requests that could hide phishing attacks.

Re: There’s no need to change passwords if they're robust, unique and not breached

#154

Post by jrodthree24 »

Moodles wrote: post #37

A lot of users will simply change their passwords by appending a 1, 2, 3, etc. at the end. Presumably if old passwords did sour and become compromised then Hashcat would easily crack the minor tweak on the new password. To be fair to these companies, the reason they do passwords so terribly is because of such poor guidance and standards in the past. Even now NIST has SP 800-132 for guidance on generating a cryptograp…

My company just fixed this. By requiring you to change your password by more than the last character. Really cutting edge security here.

Re: There’s no need to change passwords if they're robust, unique and not breached

#155

Post by Zamicol »

Darmody wrote: post #24
colinclerk wrote: post #7

Perhaps surprisingly, US government guidelines exist, are pretty fantastic, and agree with the author: Memorized secrets SHALL be at least 8 characters in length if chosen by the subscriber. Memorized secrets chosen randomly by the CSP or verifier SHALL be at least 6 characters in length and MAY be entirely numeric. If the CSP or verifier disallows a chosen memorized secret based on its appearance on a blacklist of c…

6 characters and entirely numeric seems like a bad idea, or am I missing something?

6 numeric characters is only ~20 bits. 8 is only 27 bits.

Far too short.

Re: There’s no need to change passwords if they're robust, unique and not breached

#156

Post by simonbarker87 »

harryvederci wrote: post #74
simonbarker87 wrote: post #62

For people who have to change their password regularly I suggest just adding the month and year in numbers at the end of whatever password they like to use. That way there is a clue in the current month and year as to what their password probably is should they forget

If a hacker found an old password of yours, the month an year would be a pretty easy indictor of what to try next, right?

Oh yeh it’s not ideal but the alternative is my relatives having a post-it note nearby with their current password written down - I feel this is a lesser of two evils

Re: There’s no need to change passwords if they're robust, unique and not breached

#157

Post by q3k »

tejohnso wrote: post #127
new_guy wrote: post #33

Earlier quoted context omitted.

This seems remarkably unintuitive, but the math checks out. (26+10)⁶ = 2,176,782,336 1,450 minutes a day 2,176,782,336 / (1,450 * 60) = ~25,000 years

You went from min per day multiplied by constant per min and ended up with years somehow.

My reasoning:

Number of 6-character alphanumeric passwords: (2*26+10)**6 == 56800235584

Number of seconds in a year: 60*60*24*365 == 31536000

Number of years to enumerate all 6-character alphanumeric passwords at one password a second:

  >>> ((2*26+10)**6)/(60*60*24*365)
  1801.1236549974633
(this assumes that alphanumeric is [a-zA-Z0-9], which some might disagree with)

Re: There’s no need to change passwords if they're robust, unique and not breached

#158

Post by yurishimo »

xondono wrote: post #153
Lamad123 wrote: post #137

Earlier quoted context omitted.

Special characters are OK.. The casual layperson knows how to make a special character a separator.

Special character requirements normally end with most people adding # to the end of their dictionary vulnerable password, plus a lot more of valid password reset requests that could hide phishing attacks.

#, really? The one I see most often is an exclamation mark!

Re: There’s no need to change passwords if they're robust, unique and not breached

#159

Post by solatic »

Possibly contrarian point of view:

a) Passwords should be easily rememberable. Pick four words are string them together (e.g. correcthorsebatterystaple). b) You must have a physical security key to authenticate - a Yubikey etc.

If those two factors are not enough, then forget working from home / mobile authentication - require people to arrive in-person and work in-person, with network restrictions on top of the two-factor authentication.

If two-factor authentication isn't enough, and IP address restrictions aren't of help to enforce know-your-user when they show up in person, then I swear, God help you. At that point, you're no longer practicing security, you're practicing paranoia.

Post reply on HN