Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password expiration is dead, long live passwords

techcrunch.com

Post reply on HN
Print view View original

221–230 of 316 posts

Re: Password expiration is dead, long live passwords

#221

Post by thameera »

andrewaylett wrote: post #208
tolien wrote: post #201

Earlier quoted context omitted.

Do laypeople know or care about the details of password hashing too, and if not does it matter if they know what TOTP stands for? “Scan this barcode then enter the six digit number from the app; we’ll sometimes ask for the number when you log in” isn’t particularly onerous - 1Password for example will insert your one time pass along with your password so in some cases there isn’t even an extra step to log in. I’d be…

If your TOTP key is stored in the same place as your password, is it still in any sense a second factor?

As long as it is in a place that you 'have', I believe we can technically count it as MFA.

After 1Password introduced MFA (TOTP) support, it has been used widely in organizations in shared vaults so multiple people can share critical logins that use MFA. This of course means that if your 1Password account is compromised it's game over.

Re: Password expiration is dead, long live passwords

#222

Post by rahoulb »

reaperducer wrote: post #148
Aeolun wrote: post #143

Earlier quoted context omitted.

Also not helped by the fact that passwords have to include every symbol and their mother, cannot include sequential digits, cannot include sequential letters, cannot include any letter of your name, and a bunch of other inane rules that could be changed to simply having a minimum length of 12 instead of 8...

A couple of years ago one of my banks "upgraded" its web site, forcing me to change my password to comply with its revised password guidelines since my old password was no longer permitted. The result was a password that was shorter, less varied, and less secure than the previous one. Good job, Chase.

I had a similar problem with Lloyds - every time I wanted to transfer money using the mobile app, I had to type in the password manually as they had disabled the "paste" option. Given my password was auto-generated and 16 characters long - and the password field wiped every time I did an app-switch, I just gave up.

Re: Password expiration is dead, long live passwords

#223

Post by m12k »

mattowen_uk wrote: post #184

Shifting from passwords to more secure systems such as MFA ignores the elephant in the room about passwords that no-one wants to acknowledge: People share passwords. A simple example is this: A couple do online grocery shopping every week or so, depending who has time to do it, one them will log into the 'account' and build the basket. Maybe the other will then amend the basket a few hours later before the cut off ti…

1Password allows me to share specific credentials with a person. And these credentials can include the generator for one-time-passwords.

Re: Password expiration is dead, long live passwords

#224

Post by tty2300 »

lowkeyokay wrote: post #177
erichurkman wrote: post #99

Earlier quoted context omitted.

Slack does this exceptionally well. If you forget which accounts you have, you can put in an email address and it will email you a list of your Slack accounts. If you forget your password, you can get a magic link that automatically signs in through a deep link into the app, no password needed.

But Slack then must rely on the security of your email. If the site is dealing with sensitive information like credit cards, this could be a no go.

Almost every website in existence except the most security sensitive like bank websites will allow you to reset your password with email.

Re: Password expiration is dead, long live passwords

#225

Post by Veen »

kebman wrote: post #198
Freak_NL wrote: post #178

Earlier quoted context omitted.

Always a joy when your generated password is refused: 694*C73&4:Ekp>fy>SE&o![RC (This is an example of what password-store generates.) Not good enough, because it's too long. Nothing throws you back ten years in time like having to handcraft a password to comply with all the silly rules.

You will usually get far better entropy by simply stitching together a random array of everyday words. Example: stitching better everyday words array entropy level. Anyway, as for the too-long problem, then I guess we're back to square one. :)

Strings of everyday words are better than the passwords most people choose, they're memorable, and they're often good enough from a practical perspective. But if you're using a password manager and don't have to remember passwords, you might as well use truly random passwords, which have more entropy.

Re: Password expiration is dead, long live passwords

#226

Post by thameera »

karrotwaltz wrote: post #193
Freak_NL wrote: post #178

Earlier quoted context omitted.

Always a joy when your generated password is refused: 694*C73&4:Ekp>fy>SE&o![RC (This is an example of what password-store generates.) Not good enough, because it's too long. Nothing throws you back ten years in time like having to handcraft a password to comply with all the silly rules.

Not so long ago I had to register to a website allowing a comma (or was it a semicolon?) in a password during registration but refusing to login using said password. Fun times.

I once spent 15 minutes trying to register in a local Domino's website which kept bugging me about lack of a special character - even though I had one in it. Turned out to be that the app truncates the entered password after the first 20 characters and only considers the first part. Thankfully the special character was after the 20th position so I noticed the error and fixed it, but if it wasn't I'd be wondering the next time I'm logging in why it's not letting me login with a valid password.

Re: Password expiration is dead, long live passwords

#227

Post by thameera »

rahoulb wrote: post #222
reaperducer wrote: post #148

Earlier quoted context omitted.

A couple of years ago one of my banks "upgraded" its web site, forcing me to change my password to comply with its revised password guidelines since my old password was no longer permitted. The result was a password that was shorter, less varied, and less secure than the previous one. Good job, Chase.

I had a similar problem with Lloyds - every time I wanted to transfer money using the mobile app, I had to type in the password manually as they had disabled the "paste" option. Given my password was auto-generated and 16 characters long - and the password field wiped every time I did an app-switch, I just gave up.

It's very disturbing to see that your worst passwords are for your bank accounts. Each bank I've worked with has some weird limitation like this. Not to forget that the only form of MFA that most banks allow is SMS - assuming they even offer MFA.

Re: Password expiration is dead, long live passwords

#229

Post by sejtnjir »

mattowen_uk wrote: post #184

Shifting from passwords to more secure systems such as MFA ignores the elephant in the room about passwords that no-one wants to acknowledge: People share passwords. A simple example is this: A couple do online grocery shopping every week or so, depending who has time to do it, one them will log into the 'account' and build the basket. Maybe the other will then amend the basket a few hours later before the cut off ti…

> There will always be a small percentage of situations where '1 person = 1 account' will never be true.

I agree, but this isn't an argument against the obsolence of expiring passwords regularly.

I imagine people sharing passwords are even MORE likely to share passwords in insecure ways if they are forced to change the shared password at a regular interval.

Re: Password expiration is dead, long live passwords

#230

Post by astura »

mruts wrote: post #102
extra88 wrote: post #66

Earlier quoted context omitted.

*A common use-case for millionaires. FDIC limits are $250,000 per-institution, per-account owner, per-account type (CD, money market, savings, checking) and my understanding is joint accounts are considered separate owners so two spouses could have up to $750,000 in CDs at a single bank and be fully insured.

30% of households have an aggregate net worth above 250k. So the situation GP in describing is probably very common.

I don't believe that most high net worth households are that cash heavy.

I have well over $250k net worth, the vast majority of our assets are in brokerage and retirement accounts. We have only $60k in cash.

Post reply on HN