Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

There’s no need to change passwords if they're robust, unique and not breached

tidbits.com

Post reply on HN
Print view View original

21–30 of 288 posts

Re: There’s no need to change passwords if they're robust, unique and not breached

#21

Post by q3k »

andrey_utkin wrote: post #12

I am unconvinced. What about persistent password bruteforcing? Rate limits? OK, bruteforcing is happening within those rate limits. That's how the password rots - it becomes less of a secret as many values are tried. Key material rotation seems to be a sensible practice in general.

With a ratelimit of 60 attempts per minute (which is significantly higher than any user would legitimately ever need) you're looking at thousands of years to bruteforce a random 6 character alphanumeric password.

Re: There’s no need to change passwords if they're robust, unique and not breached

#23

Post by Cr0s »

Flozzin wrote: post #3
Cr0s wrote: post #2

Do people even actually change their passwords when there is no need to do so, just because the password is old?

I update my passwords from time to time. I don't trust the organizations will always say if there is breach, know there is a breach, or actually know how far and wide a breach went.

This seems reasonable. How often do you change you passwords? Feels like it would get extremely tedious if you have more then a few accounts though, no?

Re: There’s no need to change passwords if they're robust, unique and not breached

#24

Post by Darmody »

colinclerk wrote: post #7

Perhaps surprisingly, US government guidelines exist, are pretty fantastic, and agree with the author: Memorized secrets SHALL be at least 8 characters in length if chosen by the subscriber. Memorized secrets chosen randomly by the CSP or verifier SHALL be at least 6 characters in length and MAY be entirely numeric. If the CSP or verifier disallows a chosen memorized secret based on its appearance on a blacklist of c…

6 characters and entirely numeric seems like a bad idea, or am I missing something?

Re: There’s no need to change passwords if they're robust, unique and not breached

#25

Post by thesuitonym »

andrey_utkin wrote: post #12

I am unconvinced. What about persistent password bruteforcing? Rate limits? OK, bruteforcing is happening within those rate limits. That's how the password rots - it becomes less of a secret as many values are tried. Key material rotation seems to be a sensible practice in general.

What you're saying is true, but you need to consider a regular office drone who doesn't care about security. If you require them to change the password every 90 days, you will end up with the majority of people having passwords like conS0t01, conS0t02, conS0t03... And not only will they have such weak passwords, they will boast about this to anyone who will listen, leading users to actually tell other people their password, and how they arrive at (And remember) the current mutation.

Re: There’s no need to change passwords if they're robust, unique and not breached

#26

Post by suifbwish »

whoomp12342 wrote: post #16

There is no need for passwords. Cant we figure out something better? its only been like 50 years.

I am very curious why public private key auth is not a thing for websites and applications. I would rather have a single password to the server that publicly hosts my public key then I can simply point websites and applications to that address during signup. Every app/site would check the server every 5-20 mins for changes to my public key in case I need to change it. Then I can use my private key to authenticate to all these sites/apps instead of trying to keep track of 500 damn passwords.

Re: There’s no need to change passwords if they're robust, unique and not breached

#27

Post by rabuse »

whoomp12342 wrote: post #16

There is no need for passwords. Cant we figure out something better? its only been like 50 years.

Easy for someone to say shouting from the sidelines with no ideas themselves. "Somebody should do something about this!"

Re: There’s no need to change passwords if they're robust, unique and not breached

#28

Post by e1g »

In the USA, the latest government guidance from Jan 2022 is that "Password policies MUST NOT require use of special characters or regular rotation". [1] This is a strong upgrade from earlier softer language like "don't have to/should not".

In practice, this new rule contradicts almost every InfoSec stance out there, but all government agencies must comply with this new rule by the end of the year, so expect lots of conversations and changes.

[1] https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-0... Approachable summary at https://www.bastionzero.com/blog/i-read-the-federal-governme...

Re: There’s no need to change passwords if they're robust, unique and not breached

#29

Post by chimeracoder »

ejb999 wrote: post #20

I am in the camp of requiring people to have strong passwords, and not requiring them to be changed - ever. When you ask people to remember too many passwords, they start writing them down and/or forgetting them, which leads to other problems. My oldest online account - btw it is a brokerage account at one of the big brokerage houses, where a great deal of my cash and investments sit - has not asked me to change the…

> When you ask people to remember too many passwords, they start writing them down and/or forgetting them, which leads to other problems.

Writing passwords down isn't the worst thing. If you can't convince someone to use a password manager like 1Password, getting them to use a physical notebook of unique and strong passwords is actually the next best thing, because (combined with 2FA) it protects them against the most relevant threat models for most people (phishing and password stuffing).

Re: There’s no need to change passwords if they're robust, unique and not breached

#30

Post by Flozzin »

Cr0s wrote: post #23
Flozzin wrote: post #3

Earlier quoted context omitted.

I update my passwords from time to time. I don't trust the organizations will always say if there is breach, know there is a breach, or actually know how far and wide a breach went.

This seems reasonable. How often do you change you passwords? Feels like it would get extremely tedious if you have more then a few accounts though, no?

This only applies to banking and email passwords. And most last over a year. I don't have a schedule, just one morning I wake up and go, 'oh yea, I've been using that password since 2019...'.
Post reply on HN