Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password expiration is dead, long live passwords

techcrunch.com

Post reply on HN
Print view View original

201–210 of 316 posts

Re: Password expiration is dead, long live passwords

#201

Post by tolien »

Jaruzel wrote: post #189
Jnr wrote: post #186

Earlier quoted context omitted.

MFA doesn't necessarily mean "1 person = 1 account". TOTP codes can be shared, there can always be copies of the certificates, multiple security devices added to the same profile, etc. It differs from case to case.

Which as I say, all depends on the provider implementing these extra options, in a way that the layperson can use. To me, TOTP means 'Top Of The Pops', I had to Google your acronym! How is Grandma Alice going to be able to manage these extra steps? - It's already taken over 20 years to convince people that 'Password1' is not a good password.

Do laypeople know or care about the details of password hashing too, and if not does it matter if they know what TOTP stands for?

“Scan this barcode then enter the six digit number from the app; we’ll sometimes ask for the number when you log in” isn’t particularly onerous - 1Password for example will insert your one time pass along with your password so in some cases there isn’t even an extra step to log in. I’d be more worried about people losing/wiping phones and getting locked out of their logins - who needs those backup codes, right?

Re: Password expiration is dead, long live passwords

#202

Post by tomglynch »

stephenr wrote: post #166
tomglynch wrote: post #84

Earlier quoted context omitted.

I don't think checking against haveibeenpwned is a good idea. They recommend against checking your current password, and you're automatically checking every users current password?

I don't think the comment you replied to was referring to checking a "current" password. It's about checking a "new" password when an account is created, or the password changed. Having said that - I don't see any issue with checking current passwords when the user logs in - you don't send the password to the remote service, so it can't leak that way.

Yeah I know - checking a new password is worse!

Turns out he's downloaded a hashed list and is checking against that. Which is fine.

Re: Password expiration is dead, long live passwords

#203

Post by tomglynch »

LeoPanthera wrote: post #129
tomglynch wrote: post #84

Earlier quoted context omitted.

I don't think checking against haveibeenpwned is a good idea. They recommend against checking your current password, and you're automatically checking every users current password?

The check is done locally against a hash. There's no risk of leaking the password.

Ok, that is fair. I thought you were skipping this rule from Troy Hunt (HIBP creator): "Do not send any password you actively use to a third-party service - even this one!"

Re: Password expiration is dead, long live passwords

#204

Post by msravi »

mattowen_uk wrote: post #184

Shifting from passwords to more secure systems such as MFA ignores the elephant in the room about passwords that no-one wants to acknowledge: People share passwords. A simple example is this: A couple do online grocery shopping every week or so, depending who has time to do it, one them will log into the 'account' and build the basket. Maybe the other will then amend the basket a few hours later before the cut off ti…

I don't know, but (at least some of) the apps that need multiple logins for precisely the scenario you suggest, seem to have solved this. Here in India we have some grocery apps that deliver (mainly perishables) every morning, such as Doodhwala (https://play.google.com/store/apps/details?id=com.bangertech...) and MilkBasket (https://play.google.com/store/apps/details?id=com.milkbasket...).

So I register with my phone number, I get an OTP (via SMS) and login into the system to add stuff to my basket, etc. My wife also logs in from her phone, but rather than registering afresh, uses my phone number. Now I get another OTP which she uses to login from her phone. That's it. Same account is logged into on two different phones and the login persists.

I don't know if this is by accident or design, but it works. Hopefully it'll continue to work, and they don't try to "fix" it because it wasn't meant to be that way...

Re: Password expiration is dead, long live passwords

#205

Post by kebman »

kkarakk wrote: post #171
malaysanghi wrote: post #159

Earlier quoted context omitted.

I would think anyone enforcing password expiration would make sure the password is sufficiently (subjective) different from current password. This should be simple to enforce by asking for current password when you are asking for new password. You can perform a text match before computing whatever hash you need to store.

hmmm good way to get users to become heated with your customer support. i've implemented this feature and had the CEO of the company come down 15 floors and tell me personally to revert the change for him coz it was getting confusing for him to remember passwords. Everyone else in the company also demanded it once wind of this request spread... This was the middle east, and yes they refused to use password manager pr…

It is largely agreed that Israel won the Arab-Israeli war because their NCO's on the ground were given much more leeway to make tactical decisions of their own. This was in start contrast to the top-heavy and often bureaucratic tactical decision making of the Arab League.

Why am I mentioning this? Well, if you are an army leader, and you know that your soldiers in general have an IQ score of around 82; would you let them make their own decisions on the ground? How about if your soldiers were known for having almost 115?

Yeah, sure, how you decide to make your next password may of course be down to culture, and the decision to have a password manager is perhaps too. However at some point a password manager should be a requirement for even signing up to your service, much less becoming an employee, especially if you already know about the prevalent culture.

Re: Password expiration is dead, long live passwords

#206

Post by omh »

technion wrote: post #56
omh wrote: post #26

Earlier quoted context omitted.

How are you implementing these checks? I'm using Active Directory and options for extra password checks are somewhat limited.

Microsoft has a pwnedpasswords-like service you can use: https://docs.microsoft.com/en-us/azure/active-directory/auth...

I don't think this (Azure AD Password Protection) actually implements a pwnedpasswords-style check.

It lets you upload your own custom list of banned passwords but it's limited to 1000 words. My impression is that this is intended to blacklist common words and things like your company name.

I see that Troy Hunt is now working for Microsoft so perhaps there's something in the works related to this. It seems like linking this Azure AD service to the haveibeenpwned API would be pretty straightforward.

Re: Password expiration is dead, long live passwords

#207

Post by tomglynch »

Password expiration made average users need to remember more password combinations and resulted in them using the same password for each website they use. This is a serious issue, especially when sites the size of facebook are accidentally logging plaintext passwords on their servers.

Password managers are claimed to be the solution but we just aren't seeing average users jumping on board - probably due to the added complexity.

So what's the solution? How about websites begin client side hashing as well as using SSL and hashing server side. Then every users 'password' becomes unique by having a specific salt per website. This would hugely improve the current scenario in that when a site is hacked, attackers can try every users details on a range of other sites gaining access due to password re-use.

Re: Password expiration is dead, long live passwords

#208

Post by andrewaylett »

tolien wrote: post #201
Jaruzel wrote: post #189

Earlier quoted context omitted.

Which as I say, all depends on the provider implementing these extra options, in a way that the layperson can use. To me, TOTP means 'Top Of The Pops', I had to Google your acronym! How is Grandma Alice going to be able to manage these extra steps? - It's already taken over 20 years to convince people that 'Password1' is not a good password.

Do laypeople know or care about the details of password hashing too, and if not does it matter if they know what TOTP stands for? “Scan this barcode then enter the six digit number from the app; we’ll sometimes ask for the number when you log in” isn’t particularly onerous - 1Password for example will insert your one time pass along with your password so in some cases there isn’t even an extra step to log in. I’d be…

If your TOTP key is stored in the same place as your password, is it still in any sense a second factor?

Re: Password expiration is dead, long live passwords

#209

Post by rocqua »

lowkeyokay wrote: post #177
erichurkman wrote: post #99

Earlier quoted context omitted.

Slack does this exceptionally well. If you forget which accounts you have, you can put in an email address and it will email you a list of your Slack accounts. If you forget your password, you can get a magic link that automatically signs in through a deep link into the app, no password needed.

But Slack then must rely on the security of your email. If the site is dealing with sensitive information like credit cards, this could be a no go.

Any site that has a "enter your email for a reset link" feature relies on your email security.

Re: Password expiration is dead, long live passwords

#210

Post by loonyphoenix »

tomglynch wrote: post #207

Password expiration made average users need to remember more password combinations and resulted in them using the same password for each website they use. This is a serious issue, especially when sites the size of facebook are accidentally logging plaintext passwords on their servers. Password managers are claimed to be the solution but we just aren't seeing average users jumping on board - probably due to the added…

That relies on every website implementing this solution, and I don't think such coordination is possible.

Also I don't see the advantage over just server-side hashing. Client-side hashing (without a password manager) is public, so the salt the site uses is known.

Post reply on HN