Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

There’s no need to change passwords if they're robust, unique and not breached

tidbits.com

Post reply on HN
Print view View original

211–220 of 288 posts

Re: There’s no need to change passwords if they're robust, unique and not breached

#211

Post by solatic »

khalby786 wrote: post #167
solatic wrote: post #159

Possibly contrarian point of view: a) Passwords should be easily rememberable. Pick four words are string them together (e.g. correcthorsebatterystaple). b) You must have a physical security key to authenticate - a Yubikey etc. If those two factors are not enough, then forget working from home / mobile authentication - require people to arrive in-person and work in-person, with network restrictions on top of the two-…

>network restrictions on top of the two -factor authentication That is exactly what I thought was the case too until I recently entered the code Google Authenticator gave me although my mobile was not connected to the internet. And it worked.

If you can even reach the login screen, in spite of a network control that's supposed to exist, then your network controls aren't working.

TOTP is supposed to work without a network connection.

Re: There’s no need to change passwords if they're robust, unique and not breached

#212

Post by Zamicol »

suifbwish wrote: post #26
whoomp12342 wrote: post #16

There is no need for passwords. Cant we figure out something better? its only been like 50 years.

I am very curious why public private key auth is not a thing for websites and applications. I would rather have a single password to the server that publicly hosts my public key then I can simply point websites and applications to that address during signup. Every app/site would check the server every 5-20 mins for changes to my public key in case I need to change it. Then I can use my private key to authenticate to…

I agree. Public key authentication is mature. It just needs to be adopted.

I'm not clear on the password part (I'm assuming it was a typo).

Re: There’s no need to change passwords if they're robust, unique and not breached

#213

Post by thenoblesunfish »

I’m not sure that this article sufficiently addresses the following natural objection: I don’t always know when my password has been leaked, and the chance of it having been leaked increases with time, so I should change my passwords ( to new strong, unique values) to lower the chance that they’re compromised.

Re: There’s no need to change passwords if they're robust, unique and not breached

#214

Post by marcosdumay »

tempnow987 wrote: post #202
6LLvveMx2koXfwn wrote: post #11

Earlier quoted context omitted.

6 characters in length seems a bit shoddy.

Rate limit the requests. Do an account lockout with an email click to re-enable after 10 guesses, do 2FA on new devices and you get pretty good security. For many systems, users can memorize 6 digits easily. The reality is, whatever your password reset flow is is enough. If you can reset your password with a 6 digit number via text, then that is maximum needed for actual password as well in most cases.

None of that will help you if your hash database leaks. But I'm ok with letting the decision with the user.

Re: There’s no need to change passwords if they're robust, unique and not breached

#215

Post by Sohcahtoa82 »

nixpulvis wrote: post #191
Zxian wrote: post #180

Earlier quoted context omitted.

The intent of the policy doesn't match the real-world implementation of users. Users are lazy. Users will alter a single character or digit in the password and call it changed. Most people don't use password managers, and some companies block their usage. Now add a requirement of a "secure" password.

Automated password rotation would use machine generated highly secure passwords. I do not see your point. This issue for master passwords is a bit harder, yes.

> Automated password rotation would use machine generated highly secure passwords.

Which will result in two things:

1. LOTS of calls to IT from forgotten passwords

2. People writing their passwords down on sticky notes.

Re: There’s no need to change passwords if they're robust, unique and not breached

#216

Post by the_snooze »

ryanisnan wrote: post #206
the_snooze wrote: post #197

Earlier quoted context omitted.

If you're using machine-generated passwords, then what's the point of rotating them?

Breaches happen. You can't always be sure you (or dictionaries) will know.

Even assuming a silent breach happens, it's unclear what's the value-add of password rotation in the context of other solutions that are less burdensome on the user: proper hashing of password databases (in case of a password DB breach) and risk-based authentication (in case of an inadvertent disclosure, like in logs).

Re: There’s no need to change passwords if they're robust, unique and not breached

#217

Post by etskinner »

blakesterz wrote: post #201
yurishimo wrote: post #158

Earlier quoted context omitted.

#, really? The one I see most often is an exclamation mark!

I remember reading a report a while back that said the LEAST frequently used characters are brackets { [ ] }

Seems like the reason for this is that a lot of places don't accept them as special characters. The exclamation mark (!) and hash (#) are almost guaranteed to be on the special character list, so people likely choose them out of habit.

Re: There’s no need to change passwords if they're robust, unique and not breached

#218

Post by cmiles74 »

loteck wrote: post #185
sdoering wrote: post #131

Earlier quoted context omitted.

Working at a acquisition of a big consulting corporation. Had these recommendations in place before being acquired. We're onboarded onto better security systems by new mothership. Password rotation every 75 days. No dictionary check. No check against known breached passwords. No real reasonable rules against insecure passwords (like ac_Paul2022 is valid 'secure' password). Additional massive "spyware" on corporate de…

Why should a corporation design its information controls for users who "care" about infosec, rather than designing for the overwhelming amount of users who don't care at best , and at worst are insider threats?

I don't think poster was complaining, specifically, that the security policy wasn't designed for people who care about security. In my opinion the issue is that they replaced an up-to-date and robust set of policies and tools with out-of-date tools and procedures. In addition they removed agency from their employees by installing an endpoint security tool on their machines.

I have to say, I agree! Once an endpoint security tool gets installed on my laptop and my administrator privileges have been revoked, I would definitely feel like the security of the unit was out of my hands. IMHO, this makes the organization almost entirely reliant on software and policies (which likely go unread) for security.

My belief is that this will result in an overall less secure posture for the organization as a whole. As this poster points out, his password is now less secure because whatever tool judges its strength is behind the curve. Other people may be more prone to open suspicious email under the impression that the endpoint security tool will take care of it. And so on.

Re: There’s no need to change passwords if they're robust, unique and not breached

#219

Post by tempnow987 »

marcosdumay wrote: post #214
tempnow987 wrote: post #202

Earlier quoted context omitted.

Rate limit the requests. Do an account lockout with an email click to re-enable after 10 guesses, do 2FA on new devices and you get pretty good security. For many systems, users can memorize 6 digits easily. The reality is, whatever your password reset flow is is enough. If you can reset your password with a 6 digit number via text, then that is maximum needed for actual password as well in most cases.

None of that will help you if your hash database leaks. But I'm ok with letting the decision with the user.

Interesting. In most cases if hash database leaks, the ability to crack depends on two factors, not one (password and hash difficulty) assuming you are salting properly.

You can specify pretty high difficulty with argon2id etc. Ie, shoot for a one second runtime with a very high memory requirement (you can go to GB range even).

So I'm not sure all is always necessarily lost

Re: There’s no need to change passwords if they're robust, unique and not breached

#220

Post by [deleted] »

PeterisP wrote: post #205
tempnow987 wrote: post #200

Earlier quoted context omitted.

Both password rotation and special char requirements (which often interferes with strong password generations because other systems don't support same character sets) are very much alive and well in govt contracting / vendor requirement land. Ie, they are still very very common. In a business when the password reset request rate gets high, it usually gets easier and easier to reset passwords. I worked with a govt sys…

That's why it's relevant that the NIST US government standards have changed in the last few years, and government agencies who are still requiring password rotation are not compliant and will have to remove that requirement.

[deleted]
Post reply on HN