Password expiration is dead, long live passwords • Hacker News Board

Re: Password expiration is dead, long live passwords

#21

Post by dcow » Sun, Jun 02, 2019, 9:25 PM UTC

Raistael wrote: post #3

I'm not entirely sure that I'd agree with this mentality. Sure, at a glance it sounds good. If the password has been safeguarded, there's really not much reason to force expiration. However, wouldn't the age of the password reduce the security of it by default? The longer a password exists for, the more likely it is that it can be cracked, discovered by a misplaced Post-It note, or compromised by some other unknown s…

I flat out do not buy the argument that by virtue of existing a secret becomes less secure. It's just not practically true. The assumptions needed for this to make sense are that people are actively attacking a given secret, that the new secret will be generated from arbitrary entropy (not depend in any way on the previous secret) and be a secret an attacker has already tried (otherwise the rotation was pointless). Furthermore, all keys already exist. When you "generate" one you simply pick from a large domain. The probability that two people (attacker and defender) pick the same key from the same domain does not change because someone already picked a key from the domain.

It's certainly true that as technology improves and the mechanisms we build to secure things evolve new keys need to be used in order to stay up-to-date. But this amounts to secret rotation that aligns with evolving systems not arbitrary 90-day expiration policies. Much different argument.

Keys should not be rotated.. security strategies should.

Re: Password expiration is dead, long live passwords

#22

Post by javagram » Sun, Jun 02, 2019, 9:25 PM UTC

discreditable wrote: post #12

I still expire passwords on a yearly basis for the sole reason that users have complained to me that it stops them from using the password they use for everything else.

I guess other options could be not allowing the users to set their own password but instead generating a password for them.

Or just require 2FA for everything, but that’s hard to do with a lot of software.

Re: Password expiration is dead, long live passwords

#23

Post by LeoPanthera » Sun, Jun 02, 2019, 9:27 PM UTC

jeremyjh wrote: post #17

discreditable wrote: post #12

I still expire passwords on a yearly basis for the sole reason that users have complained to me that it stops them from using the password they use for everything else.

I came here to say this. I can't think of another way to guarantee that they aren't using the same password that they use on every website they've visited since 1997. If anyone has suggestions on this I'd love to hear it.

What I do:

1. Check the password against the haveibeenpwned.com database.

2. Check the password with the zxcvbn password strength library.

If it passes both they can use it. It's not perfect, but it's a lot better than nothing.

Re: Password expiration is dead, long live passwords

#24

Post by dessant » Sun, Jun 02, 2019, 9:27 PM UTC

That's exciting news, though it will take a couple of years until it trickles down to financial institutions. My bank forces me to change passwords every 3 months, and of course they also disable pasting for added security.

We also have a local utility that sends you a 5 letter password upon account creation through email, and that's your password. If you try to change it, they'll send you another 5 letter one.

Re: Password expiration is dead, long live passwords

#25

Post by omh » Sun, Jun 02, 2019, 9:28 PM UTC

jeremyjh wrote: post #17

discreditable wrote: post #12

I still expire passwords on a yearly basis for the sole reason that users have complained to me that it stops them from using the password they use for everything else.

I came here to say this. I can't think of another way to guarantee that they aren't using the same password that they use on every website they've visited since 1997. If anyone has suggestions on this I'd love to hear it.

This is definitely a dilemma.

If you're using Google Accounts then they have a feature for this[1]. It detects when they enter their Google password into any other site then reports it and makes them change their password. I'd love a similar feature that somehow worked with Active Directory.

[1] Password Alert: https://support.google.com/a/answer/6197480

Re: Password expiration is dead, long live passwords

#26

Post by omh » Sun, Jun 02, 2019, 9:28 PM UTC

LeoPanthera wrote: post #23

jeremyjh wrote: post #17

Earlier quoted context omitted.

I came here to say this. I can't think of another way to guarantee that they aren't using the same password that they use on every website they've visited since 1997. If anyone has suggestions on this I'd love to hear it.

What I do: 1. Check the password against the haveibeenpwned.com database. 2. Check the password with the zxcvbn password strength library. If it passes both they can use it. It's not perfect, but it's a lot better than nothing.

How are you implementing these checks?

I'm using Active Directory and options for extra password checks are somewhat limited.

Re: Password expiration is dead, long live passwords

#27

Post by discreditable » Sun, Jun 02, 2019, 9:29 PM UTC

cjensen wrote: post #18

discreditable wrote: post #12

I still expire passwords on a yearly basis for the sole reason that users have complained to me that it stops them from using the password they use for everything else.

That's amusing but... those same users are likely to be using just altering their passwords a little like "passwd1" "passwd2", etc. You aren't gaining anything.

I'm sure they are, but I think predictability is slightly less bad than being distributed across every single service they've ever used. There's only so much I can do about people not giving a crap.

Re: Password expiration is dead, long live passwords

#28

Post by LeoPanthera » Sun, Jun 02, 2019, 9:30 PM UTC

omh wrote: post #26

LeoPanthera wrote: post #23

Earlier quoted context omitted.

What I do: 1. Check the password against the haveibeenpwned.com database. 2. Check the password with the zxcvbn password strength library. If it passes both they can use it. It's not perfect, but it's a lot better than nothing.

How are you implementing these checks? I'm using Active Directory and options for extra password checks are somewhat limited.

Oh sorry I'm not using AD, it's just a web service.

Re: Password expiration is dead, long live passwords

#29

Post by scarejunba » Sun, Jun 02, 2019, 9:31 PM UTC

davemp wrote: post #2

I've always wondered how many engineer hours have been lost on the phone with helpdesks sorting out expired passwords.

The real problem? People introduce password expiration to improve security, but the means of producing a new unexpired password after being locked out is less secure than the password itself creating a net loss in security.

Re: Password expiration is dead, long live passwords

#30

Post by antoineMoPa » Sun, Jun 02, 2019, 9:33 PM UTC

dessant wrote: post #24

That's exciting news, though it will take a couple of years until it trickles down to financial institutions. My bank forces me to change passwords every 3 months, and of course they also disable pasting for added security. We also have a local utility that sends you a 5 letter password upon account creation through email, and that's your password. If you try to change it, they'll send you another 5 letter one.

Bank programmers live at least 5 years in the past.