The first time I came across password expiration was on a login I was given to someone else's windows server. I only needed to log in once a month or less and every single time I got the message, your password has expired and must be changed, it was laughably pathetic how they ever expected people to remember a new hard to guess password every month. So of course I did what others have said and tagged on a 1 each time to the end.
Password expiration is dead, long live passwords
191–200 of 316 posts
Re: Password expiration is dead, long live passwords
#192Ah good stuff. Password expiration is a pain, but it's worse for Windows login because I can't even open Keepass until I get in! When forced to do this I will use something like "B@s3P@ssw0rd1" then "B@s3P@ssw0rd2", "B@s3P@ssw0rd3" etc.
That's still a weak password. Letter substitution doesn't increase the difficultly, as password crackers try all the variants as a matter of course. Better to use a combo of several words such as... BatteryHorseStaple. :)
The point was changing the number at the end to work around the requirement to change the password. My real pw was better.
Re: Password expiration is dead, long live passwords
#193Earlier quoted context omitted.
Also not helped by the fact that passwords have to include every symbol and their mother, cannot include sequential digits, cannot include sequential letters, cannot include any letter of your name, and a bunch of other inane rules that could be changed to simply having a minimum length of 12 instead of 8...
Always a joy when your generated password is refused: 694*C73&4:Ekp>fy>SE&o![RC (This is an example of what password-store generates.) Not good enough, because it's too long. Nothing throws you back ten years in time like having to handcraft a password to comply with all the silly rules.
Not so long ago I had to register to a website allowing a comma (or was it a semicolon?) in a password during registration but refusing to login using said password. Fun times.
Re: Password expiration is dead, long live passwords
#194Shifting from passwords to more secure systems such as MFA ignores the elephant in the room about passwords that no-one wants to acknowledge: People share passwords. A simple example is this: A couple do online grocery shopping every week or so, depending who has time to do it, one them will log into the 'account' and build the basket. Maybe the other will then amend the basket a few hours later before the cut off ti…
I agree sharing passwords is a really common thing, even among corporate / enterprise SaaS. Even with MFA people share dongles / code pads.
But the correct pattern is a formal system for delegation and/or disconnecting 'login' with 'account' (i.e. separate charging for a service from the login). This is something that AWS does very well for example.
Re: Password expiration is dead, long live passwords
#195Earlier quoted context omitted.
Some never memorize their passwords at all. Instead relying on 'forgot' emails and "Remember Me" features entirely.
I have wondered if some web pages effectively have this as the main log in method. If you have a hurricane tracking page, everyone is going to forget their passwords in between hurricane seasons.
medium.com is famous for email OTP authentication. They even blogged about it (search hacker news for more information)
Re: Password expiration is dead, long live passwords
#196Shifting from passwords to more secure systems such as MFA ignores the elephant in the room about passwords that no-one wants to acknowledge: People share passwords. A simple example is this: A couple do online grocery shopping every week or so, depending who has time to do it, one them will log into the 'account' and build the basket. Maybe the other will then amend the basket a few hours later before the cut off ti…
MFA doesn't necessarily mean "1 person = 1 account". TOTP codes can be shared, there can always be copies of the certificates, multiple security devices added to the same profile, etc. It differs from case to case.
Most users with TOTP assume that TOTP is bound to their app (often Google Authenticator without a backup option / migration path AFAIK). Technically, you are of course fully correct.
Re: Password expiration is dead, long live passwords
#197Shifting from passwords to more secure systems such as MFA ignores the elephant in the room about passwords that no-one wants to acknowledge: People share passwords. A simple example is this: A couple do online grocery shopping every week or so, depending who has time to do it, one them will log into the 'account' and build the basket. Maybe the other will then amend the basket a few hours later before the cut off ti…
I agree sharing passwords is a really common thing, even among corporate / enterprise SaaS. Even with MFA people share dongles / code pads. But the correct pattern is a formal system for delegation and/or disconnecting 'login' with 'account' (i.e. separate charging for a service from the login). This is something that AWS does very well for example.
Exactly, built-in delegation and impersation features solve this. AWS IAM and Kubernetes have great implementations. Hopefully we get some more standards like OAuth so people talk about this stuff more.
Re: Password expiration is dead, long live passwords
#198Earlier quoted context omitted.
Also not helped by the fact that passwords have to include every symbol and their mother, cannot include sequential digits, cannot include sequential letters, cannot include any letter of your name, and a bunch of other inane rules that could be changed to simply having a minimum length of 12 instead of 8...
Always a joy when your generated password is refused: 694*C73&4:Ekp>fy>SE&o![RC (This is an example of what password-store generates.) Not good enough, because it's too long. Nothing throws you back ten years in time like having to handcraft a password to comply with all the silly rules.
You will usually get far better entropy by simply stitching together a random array of everyday words. Example: stitching better everyday words array entropy level. Anyway, as for the too-long problem, then I guess we're back to square one. :)
Re: Password expiration is dead, long live passwords
#199"Periodic password expiration is a defense only against the probability that a password (or hash) will be stolen during its validity interval and will be used by an unauthorized entity. If a password is never stolen, there’s no need to expire it. And if you have evidence that a password has been stolen, you would presumably act immediately rather than wait for expiration to fix the problem." Full post: https://blogs.…
Assuming there is no zero day exploit. But then I'm paranoid.
Re: Password expiration is dead, long live passwords
#200Earlier quoted context omitted.
I did some lunch table math a few weeks ago. Assuming it takes on average 30 min for an employee to rotate a password (reboots, re-logins, etc.), assuming an average $50/hr across all employees, ~600k employees @ 4 changes per year (my current company policy is ever 80-ish days) = $60MM of human time spent per year making the company less secure .
It doesn’t take 30 minutes to change my password from ‘password5’ to ‘password6’ though.
If I don't restart my laptop after changing my password, I'm saving up for a whole load of shit. The proxy logins may, or may not, continue to work, but it's highly likely that at some point in the next few hours, Outlook is going to trigger 3 failed password checks and lock me out of my mailbox.
And that's assuming it expires when I'm in the office, whereas what seems to happen roughly half the time is it expires when I'm connected via the VPN.