Password expiration is dead, long live passwords

Post by nsuser3 » Mon, Jun 03, 2019, 9:11 AM UTC

kebman wrote: post #198

Freak_NL wrote: post #178

Earlier quoted context omitted.

Always a joy when your generated password is refused: 694*C73&4:Ekp>fy>SE&o![RC (This is an example of what password-store generates.) Not good enough, because it's too long. Nothing throws you back ten years in time like having to handcraft a password to comply with all the silly rules.

You will usually get far better entropy by simply stitching together a random array of everyday words. Example: stitching better everyday words array entropy level. Anyway, as for the too-long problem, then I guess we're back to square one. :)

Post by tomglynch » Mon, Jun 03, 2019, 9:13 AM UTC

loonyphoenix wrote: post #210

tomglynch wrote: post #207

Password expiration made average users need to remember more password combinations and resulted in them using the same password for each website they use. This is a serious issue, especially when sites the size of facebook are accidentally logging plaintext passwords on their servers. Password managers are claimed to be the solution but we just aren't seeing average users jumping on board - probably due to the added…

That relies on every website implementing this solution, and I don't think such coordination is possible. Also I don't see the advantage over just server-side hashing. Client-side hashing (without a password manager) is public, so the salt the site uses is known.

Post by rocqua » Mon, Jun 03, 2019, 9:16 AM UTC

malaysanghi wrote: post #159

lysp wrote: post #146

Earlier quoted context omitted.

The problem with having a short expiration is that it forces people to simply use their password with a count: password1, password2, ... password23, password24. This means that if you discover someone's current password, you also have their future 10+ passwords as well.

I would think anyone enforcing password expiration would make sure the password is sufficiently (subjective) different from current password. This should be simple to enforce by asking for current password when you are asking for new password. You can perform a text match before computing whatever hash you need to store.

Post by faceplanted » Mon, Jun 03, 2019, 9:21 AM UTC

mattowen_uk wrote: post #184

Shifting from passwords to more secure systems such as MFA ignores the elephant in the room about passwords that no-one wants to acknowledge: People share passwords. A simple example is this: A couple do online grocery shopping every week or so, depending who has time to do it, one them will log into the 'account' and build the basket. Maybe the other will then amend the basket a few hours later before the cut off ti…

Post by n_u_l_l » Mon, Jun 03, 2019, 9:31 AM UTC

faceplanted wrote: post #217

mattowen_uk wrote: post #184

Shifting from passwords to more secure systems such as MFA ignores the elephant in the room about passwords that no-one wants to acknowledge: People share passwords. A simple example is this: A couple do online grocery shopping every week or so, depending who has time to do it, one them will log into the 'account' and build the basket. Maybe the other will then amend the basket a few hours later before the cut off ti…

YouTube has this problem to an insane degree, some large businesses are run from a single person's long standing Google account and there's no way to give another YouTube account any privileges you might want an employee to have without giving them access to your entire Google account and all attached services including your emails, the ability to locate and wipe your phone, all the photos on your phone via Google ph…