Password expiration is dead, long live passwords • Hacker News Board

Re: Password expiration is dead, long live passwords

#181

Post by 5350-uiop-1130 » Mon, Jun 03, 2019, 7:06 AM UTC

I wish every compnay that does this will stop too. It's so frustrating and annoying having to change my passwords so regularly.

The internal time management software we use at work, which I only access every few weeks always forces me to set a new password. So every time I come to log on, my password has expired. What makes it worse is that this password is connected to other work services but they're not synchronised so when I change one, the other doesn't always change for a couple of days. Sometimes, the only way to log in to my machine is to disconnect the ethernet and make sure the wifi is off. And I have to keep a document on my phone with every variation of my passwords in the last few months and even then, if I am on holiday for a while and come back to work, none of them work.

I think there is a class of companies and services (Excluding Microsoft) who just need to leave the business of user security to the user and stop trying to build walls around an enclosure that no one cares about in the first place.

Re: Password expiration is dead, long live passwords

#182

Post by Jaruzel » Mon, Jun 03, 2019, 7:10 AM UTC

quickthrower2 wrote: post #77

Ah good stuff. Password expiration is a pain, but it's worse for Windows login because I can't even open Keepass until I get in! When forced to do this I will use something like "B@s3P@ssw0rd1" then "B@s3P@ssw0rd2", "B@s3P@ssw0rd3" etc.

That's still a weak password. Letter substitution doesn't increase the difficultly, as password crackers try all the variants as a matter of course.

Better to use a combo of several words such as... BatteryHorseStaple. :)

Re: Password expiration is dead, long live passwords

#183

Post by Jaruzel » Mon, Jun 03, 2019, 7:16 AM UTC

louis-paul wrote: post #165

These “baseline rules” come from NIST SP 800-63B, Appendix A, which is a surprisingly digestible document: https://pages.nist.gov/800-63-3/sp800-63b.html#appA

And the UK equivalent from the National Cyber Security Council is at:

https://www.ncsc.gov.uk/collection/passwords/updating-your-a...

Fun anecdote... I spent 6 months last year designing and implementing a 'Self-Service' password reset portal system and password synchronisation system for 50k+ users in a large organisation, only for the organisation in question to switch to non-expiring passwords 1 week before deployment.

Needless to say... usage of the system post deployment was almost non-existent.

Ah well, at least I still got paid.

Re: Password expiration is dead, long live passwords

#184

Post by mattowen_uk » Mon, Jun 03, 2019, 7:28 AM UTC

Shifting from passwords to more secure systems such as MFA ignores the elephant in the room about passwords that no-one wants to acknowledge: People share passwords.

A simple example is this: A couple do online grocery shopping every week or so, depending who has time to do it, one them will log into the 'account' and build the basket. Maybe the other will then amend the basket a few hours later before the cut off time. With enforced MFA, this is not possible.

There will always be a small percentage of situations where '1 person = 1 account' will never be true. Until providers add the concept of multi-logins to the same 'account' on their systems you can't wholesale move to stronger security methods.

I have the same issue with all these 'smart home' products that need an app installed onto a phone or tablet. A lot of them are bound to a single account, which means if other people in the household also want to have the app, you have to share your account details. if it's a Google or Amazon product, that means you are sharing account details of an account that you really shouldn't be.

Re: Password expiration is dead, long live passwords

#185

Post by xioxox » Mon, Jun 03, 2019, 7:34 AM UTC

dessant wrote: post #24

That's exciting news, though it will take a couple of years until it trickles down to financial institutions. My bank forces me to change passwords every 3 months, and of course they also disable pasting for added security. We also have a local utility that sends you a 5 letter password upon account creation through email, and that's your password. If you try to change it, they'll send you another 5 letter one.

German banks also like their 5 character passwords! Fortunately you also need a per-transaction TAN code which makes this a bit better (though many people have this on paper or via an SMS, though perhaps paper is not that bad).

Re: Password expiration is dead, long live passwords

#186

Post by Jnr » Mon, Jun 03, 2019, 7:35 AM UTC

mattowen_uk wrote: post #184

Shifting from passwords to more secure systems such as MFA ignores the elephant in the room about passwords that no-one wants to acknowledge: People share passwords. A simple example is this: A couple do online grocery shopping every week or so, depending who has time to do it, one them will log into the 'account' and build the basket. Maybe the other will then amend the basket a few hours later before the cut off ti…

MFA doesn't necessarily mean "1 person = 1 account". TOTP codes can be shared, there can always be copies of the certificates, multiple security devices added to the same profile, etc. It differs from case to case.

Re: Password expiration is dead, long live passwords

#187

Post by kebman » Mon, Jun 03, 2019, 7:36 AM UTC

mattowen_uk wrote: post #184

Shifting from passwords to more secure systems such as MFA ignores the elephant in the room about passwords that no-one wants to acknowledge: People share passwords. A simple example is this: A couple do online grocery shopping every week or so, depending who has time to do it, one them will log into the 'account' and build the basket. Maybe the other will then amend the basket a few hours later before the cut off ti…

You shouldn't take that shortcut over the lawn either. There are two answers to that very basic design problem: 1. Build higher fences to force people to walk along the prescribed path. This is often met with resentment, and various attempts at climbing the fence, or even cutting it down. 2. Lay bricks along the new organic path, so that it's safer to traverse. I like the latter choice. The principle is just about the same in the digital world.

Re: Password expiration is dead, long live passwords

#188

Post by seqizz » Mon, Jun 03, 2019, 7:38 AM UTC

dwaite wrote: post #114

matt_morgan wrote: post #103

Earlier quoted context omitted.

This ignores the fact that most people use the same password everywhere, given the opportunity, and you have no idea what website has been breached. I.e. if you don't expire passwords, most people will use the same password everywhere, and you don't know when a compromise has happened, because it happened on some totally other network.

This doesn't need to be solved via time-based expiry though - you can use a breach list (like checking https://haveibeenpwned.com on registration,login, and password change). Even an aggressive password change policy is typically one month since last change, which would give a long window for access. Secondary factors, if at no other time then on first use of a machine, are also a good technique to prevent password b…

List-checking can't help every time. Some people use "clever" tactics to use slightly different passwords (hunter2fb for Facebook, hunter2tw for Twitter).

Re: Password expiration is dead, long live passwords

#189

Post by Jaruzel » Mon, Jun 03, 2019, 7:42 AM UTC

Jnr wrote: post #186

mattowen_uk wrote: post #184

Shifting from passwords to more secure systems such as MFA ignores the elephant in the room about passwords that no-one wants to acknowledge: People share passwords. A simple example is this: A couple do online grocery shopping every week or so, depending who has time to do it, one them will log into the 'account' and build the basket. Maybe the other will then amend the basket a few hours later before the cut off ti…

MFA doesn't necessarily mean "1 person = 1 account". TOTP codes can be shared, there can always be copies of the certificates, multiple security devices added to the same profile, etc. It differs from case to case.

Which as I say, all depends on the provider implementing these extra options, in a way that the layperson can use.

To me, TOTP means 'Top Of The Pops', I had to Google your acronym! How is Grandma Alice going to be able to manage these extra steps? - It's already taken over 20 years to convince people that 'Password1' is not a good password.

Re: Password expiration is dead, long live passwords

#190

Post by loup-vaillant » Mon, Jun 03, 2019, 7:44 AM UTC

mypalmike wrote: post #163

loup-vaillant wrote: post #46

Earlier quoted context omitted.

> password simplification is a user choice, not a causal effect The two are not mutually exclusive. If you require users to change passwords regularly, and also make sure the new password is sufficiently different from the last one (like, most characters must be different or something), guess what the users are likely to choose of their own so called free will. And I'm not even speaking of how you must store a passwo…

> Also good luck trying to defeat my strategy (or similar strategies) without storing more than a hash of the password Enter Old Password: Complicatedpassword1 Enter New Password: Complicatedpassword2 Sorry, your new password is too similar to your old password. (Passwords are still stored and verified using hashing, but with a form like this, your most recent and new passwords are available in plaintext for comparis…

Crap, I forgot about that. I guess I'll have to swap words if that ever happens:

  Complicatedpassword1
  PasswordComplicated1
  Complicatedpassword2
  PasswordComplicated2
  Complicatedpassword3
  PasswordComplicated3

And if that fails, they win. Clearly they don't care about security, so I'll use a weaker password. And I will note it on a post-it and keep it in my wallet.