181–190 of 288 posts
Earlier quoted context omitted.
10+ years of data has strongly indicated that yes indeed "rotation is a bad idea, because users don't use strong passwords when they are forced to rotate them"
Please read my full comment.
A: It's a good idea! B: In theory, yes. In practice, no. A: I'm only talking theory.
Great. The rest of us are talking about practice.
Earlier quoted context omitted.
That's what makes it a bad password.
It's a fantastic example of both how to create memorable high entropy passwords, and a class of passwords that many systems don't allow. I don't think anyone, even the original responder, views it as an actual password we should all use.
Earlier quoted context omitted.
It's not 10 because it still needs to be memorized.
I know it's hard to imagine, but before we all held supercomputers in our pockets we all used to have dozens of ten-digit numbers memorized. I still remember my grade school friends' phone numbers.
I feel like this post was intended to inflame or shock the reader with the writers stance on password policy. But anyone who has been in security for more than 1 month knows that regular password rotation has not been a recommendation for over 5 years. Both NIST, and MS have been trying to get the world to move to long, never rotated password, so long as those passwords are dictionary checked. Every company (all 3 of…
Working at a acquisition of a big consulting corporation. Had these recommendations in place before being acquired. We're onboarded onto better security systems by new mothership. Password rotation every 75 days. No dictionary check. No check against known breached passwords. No real reasonable rules against insecure passwords (like ac_Paul2022 is valid 'secure' password). Additional massive "spyware" on corporate de…
Earlier quoted context omitted.
6 characters and entirely numeric seems like a bad idea, or am I missing something?
My reading was not that it must be entirely numeric, but that there is no rule that it won't be. As in, an attacker cannot make any assumptions about the characters in the randomly chosen password, such as "well it won't be all numbers, so lets rule out all those possibilities The 6 character limit only seems to apply to randomly assigned ones, not to ones the user picks, which is where a strategy like "what about al…
Which means that an attacker now knows that moving "only numeric" to the beginning of their attack sequence may be a viable strategy. Whereas if the rule did not specify, the attack would not be able to make assumptions about the character set.
I feel like this post was intended to inflame or shock the reader with the writers stance on password policy. But anyone who has been in security for more than 1 month knows that regular password rotation has not been a recommendation for over 5 years. Both NIST, and MS have been trying to get the world to move to long, never rotated password, so long as those passwords are dictionary checked. Every company (all 3 of…
So why do I have an Azure password that I have to change every few months? I always set it to a randomly generated string; certainly not anything in a dictionary.
Earlier quoted context omitted.
Working at a acquisition of a big consulting corporation. Had these recommendations in place before being acquired. We're onboarded onto better security systems by new mothership. Password rotation every 75 days. No dictionary check. No check against known breached passwords. No real reasonable rules against insecure passwords (like ac_Paul2022 is valid 'secure' password). Additional massive "spyware" on corporate de…
I know of a non-zero and non-one amounts of the following passwords in idiotic "60 day rotation policies" Password($MONTH)($YEAR)! Or, PasswordJanuary2022! It easily increments to deal with stupid arbitrary rotations, passes most tests, has the small/large/number/symbol requirements. And it's sooooooo hackable its not funny. Hell, 2 jobs ago, I ran this precisely because of 60d rotation garbage.
Earlier quoted context omitted.
That provides one million possibilities. I don't think you're missing anything. That's pretty terrible. The only thing prolonging your account at that point is the service's rate-limiting, assuming a naive "enter this password in the login field, try it, repeat."
On the other hand, if you have too many password requirements and the user can’t remember it, they often lean on bad password hygiene, and the password ends up being reused (and inevitably leaked) or written down somewhere.