Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password expiration is dead, long live passwords

techcrunch.com

Post reply on HN
Print view View original

171–180 of 316 posts

Re: Password expiration is dead, long live passwords

#171

Post by kkarakk »

malaysanghi wrote: post #159
lysp wrote: post #146

Earlier quoted context omitted.

The problem with having a short expiration is that it forces people to simply use their password with a count: password1, password2, ... password23, password24. This means that if you discover someone's current password, you also have their future 10+ passwords as well.

I would think anyone enforcing password expiration would make sure the password is sufficiently (subjective) different from current password. This should be simple to enforce by asking for current password when you are asking for new password. You can perform a text match before computing whatever hash you need to store.

hmmm good way to get users to become heated with your customer support. i've implemented this feature and had the CEO of the company come down 15 floors and tell me personally to revert the change for him coz it was getting confusing for him to remember passwords. Everyone else in the company also demanded it once wind of this request spread...

This was the middle east, and yes they refused to use password manager programs because they didn't understand them

Re: Password expiration is dead, long live passwords

#173

Post by eicnix »

setzer22 wrote: post #169
reaperducer wrote: post #148

Earlier quoted context omitted.

A couple of years ago one of my banks "upgraded" its web site, forcing me to change my password to comply with its revised password guidelines since my old password was no longer permitted. The result was a password that was shorter, less varied, and less secure than the previous one. Good job, Chase.

> my old password was no longer permitted. But how did they know? They should just have the hash...

If they implemented it properly they could have checked the current password against the revised guidelines on the next login. No need to store it in plain text

Re: Password expiration is dead, long live passwords

#174

Post by uberswe »

setzer22 wrote: post #169
reaperducer wrote: post #148

Earlier quoted context omitted.

A couple of years ago one of my banks "upgraded" its web site, forcing me to change my password to comply with its revised password guidelines since my old password was no longer permitted. The result was a password that was shorter, less varied, and less secure than the previous one. Good job, Chase.

> my old password was no longer permitted. But how did they know? They should just have the hash...

The website can check the password during login without storing it in plaintext

Re: Password expiration is dead, long live passwords

#175

Post by enriquto »

browningstreet wrote: post #91

Recent, frustrating example: My (business) bank uses FISERV software, and their software expires passwords every 90 days. Their software can notify you about a million combinations of account activities and statuses, except this one. It takes 3 values to login to the account (company ID, username, password). When logging in via mobile app, it never tells you that your password has expired, so I end up trying a few ti…

> When I called the bank to find out how to get notifications that a password has expired, they said there was no way. "When you change your password, set a calendar event for 60 days ahead..." they told me

This is a very good reason to change bank. That unacceptable answer would certainly induce me to rage quit the service, whatever the inconvenience.

Re: Password expiration is dead, long live passwords

#176

Post by systemfreund »

setzer22 wrote: post #169
reaperducer wrote: post #148

Earlier quoted context omitted.

A couple of years ago one of my banks "upgraded" its web site, forcing me to change my password to comply with its revised password guidelines since my old password was no longer permitted. The result was a password that was shorter, less varied, and less secure than the previous one. Good job, Chase.

> my old password was no longer permitted. But how did they know? They should just have the hash...

The login form usually sends the password in cleartext and it's then hashed on the server-side prior to comparing it to the hash stored in the database.

So they can just determine the password's strength at the time when the user is logging in

Re: Password expiration is dead, long live passwords

#177

Post by lowkeyokay »

erichurkman wrote: post #99
tty2300 wrote: post #45

Earlier quoted context omitted.

Which isn't even that bad of an idea. Some website basically use this as the only way to log in.

Slack does this exceptionally well. If you forget which accounts you have, you can put in an email address and it will email you a list of your Slack accounts. If you forget your password, you can get a magic link that automatically signs in through a deep link into the app, no password needed.

But Slack then must rely on the security of your email. If the site is dealing with sensitive information like credit cards, this could be a no go.

Re: Password expiration is dead, long live passwords

#178

Post by Freak_NL »

Aeolun wrote: post #143
omh wrote: post #36

Earlier quoted context omitted.

Unfortunately we still have to have similar authentication methods for other password resets. Users have an alarming tendency to forget their passwords after a week or two of holiday.

Also not helped by the fact that passwords have to include every symbol and their mother, cannot include sequential digits, cannot include sequential letters, cannot include any letter of your name, and a bunch of other inane rules that could be changed to simply having a minimum length of 12 instead of 8...

Always a joy when your generated password is refused:

    694*C73&4:Ekp>fy>SE&o![RC
(This is an example of what password-store generates.)

Not good enough, because it's too long. Nothing throws you back ten years in time like having to handcraft a password to comply with all the silly rules.

Re: Password expiration is dead, long live passwords

#180

Post by rimliu »

antoineMoPa wrote: post #30
dessant wrote: post #24

That's exciting news, though it will take a couple of years until it trickles down to financial institutions. My bank forces me to change passwords every 3 months, and of course they also disable pasting for added security. We also have a local utility that sends you a 5 letter password upon account creation through email, and that's your password. If you try to change it, they'll send you another 5 letter one.

Bank programmers live at least 5 years in the past.

Depends on the bank. I guess in US banks themselves are 20 years in the past. My bank had this log-in setup, where you have your fixed password but also need to enter a password from your password card. This is being phased out and will not be available from Sep 1st. I myself have been using mobile signature/smart-id (https://www.smart-id.com) for years now. Other remaining options are using your ID card or passcode generators—like Google Authenticator but a physical device.
Post reply on HN