Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

49% of workers, forced to change passwords, reuse same one with minor change

grahamcluley.com

Post reply on HN
Print view View original

221–230 of 316 posts

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#221

Post by other_herbert »

fancyfish wrote: post #210

My most memorable policy as an end user was as a consulting client for a huge bank. On top of the usual length, character type, and password changing requirements, the password could not use substrings of 3+ characters from any of your prior passwords. They were also required to pass a black-box “complexity” algorithm, and the vast majority of passwords generated by my password manager inexplicably failed this bar. S…

The terrible implication with that is, is that somewhere the plain text of your history of passwords was stored

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#222

Post by ativzzz »

Dylan16807 wrote: post #148
akira2501 wrote: post #97

Earlier quoted context omitted.

To me, there's an irony in that "Zaphod Beeblebrox's kite harasses Tuscon." is not only _more_ memorable on it's own, but is probably a _better_ password than "ZBw3hHg1tFWdhdt?Hoh2hXcrZmn" Stop using passwords, just use a "pass sentence." My last few passwords at my previous employer: "Tim, bring me chicken #15" "Mary, stop looking at me!" "Nothing you can do about 2!" "The coffee here is gross." Seriously.

There's absolutely no way a five word password is better than 32 random characters. Two plain old random words, the entropy of that is less than 16 bits each, but we'll round up. One of the biggest cities in the US is probably even less useful, but let's credit it for 16 bits. And let's rate Zaphod Beeblebrox as one-in-a-million for entropy purposes. That's 68 bits. It's somewhere between 11 and 12 random alphanumeri…

I like to also purposefully misspell words, or use some kind of alternative representation of letters, like use 'keeb0rd' instead of 'keyboard'.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#223

Post by lawl »

mongol wrote: post #209
lawl wrote: post #136

Earlier quoted context omitted.

Very doable. I also want(ed) this. There are some old kernel patches on github that extend the android USB driver to also be able to register as an HID device. I also tried kicking the android driver and just using (iirc) usbfs or what is was called so you could implement HID in userspace and repurpose old phones while kicking android. But the vendor kernel stopped compiling :/ This woul imo be a really interesting a…

I also looked into this but was disappointed when I found that android support for USB HID only goes in one direction. You can attach a keyboard to your phone, but your phone cannot act like one. There are so many useful usecases for a phone like a keyboard it is too bad...

Yeah, this is why you either need to disable the android usb driver and use default linux ones (enabling which, broke the compile for the vendor kernel on my device)

Or patch the android stuff to add HID support: https://github.com/pelya/android-keyboard-gadget

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#224

Post by SlowRobotAhead »

hwbehrens wrote: post #7

This should not be a surprise, as this supports the NIST's revised recommendations (from June 2017!) that passwords should not expire [0], because it actually leads to less-secure passwords for this exact reason. Furthermore, many corporate systems do not integrate well with password managers, such as when first logging in to your system in the morning. This means that the password is likely to be one of the few that…

When this came out I wasn’t directing IT... I had to (fucking) fight tooth and nail to get our MSP and CFO to accept it.

CFO no longer has anything to do with IT, MSP was fired... not for this, for leaving admin credentials in JSON file accessible to everyone on a shared drive.

Ah, good times!

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#225

Post by osteele »

peteretep wrote: post #103
fluidcruft wrote: post #102

Earlier quoted context omitted.

It would be really cool if you could plug your phone in and it appeared as a USB keyboard device and you could "type" the password from the password manager that way without ever giving the computer access to anything except that password. Maybe some sort of simple USB dongle (like a yubikey) could be fed by the phone via bluetooth or nfc to do this?

It would be even cooler if I could open an app on my phone, point it at a QR code on screen, and not have anything else bother me

This seems to be the default for web apps here in China, such as Taobao or JD. Either the home page or the login page presents a QR code, and the mobile app has a scan icon.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#226

Post by pnako »

obelos wrote: post #123

I used to have to deal with an enterprise system that required quarterly password changes. The interesting thing about this system was it would refuse to let you set a new password that wasn't sufficiently different from the previous several passwords... Which almost certainly means they were implementing this security measure by storing the passwords in plaintext on the server.

Not necessarily. You could try simple variations of every single character of the password (lower/uppercase, previous/next character) and try to hash that and compare to the previous passwords. That's just ~30 hashes for a 10 letter password.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#228

Post by nirvdrum »

thenewnewguy wrote: post #108
trianglem wrote: post #52

Earlier quoted context omitted.

I agree with all of this except password managers. If you use a lot of different public computers or temporary work laptops they don’t always let you install LastPass, so I frequently ended up being unable to access my accounts.

LastPass (like all other good online password managers) has a web UI.

I had an employer that blocked access to lastpass.com to discourage that sort of thing. I guess the idea is you shouldn't be using a work computer for personal stuff and you shouldn't put work passwords on a 3rd part site. In reality, things aren't split that cleanly, so the block was annoying.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#229

Post by rorykoehler »

orand wrote: post #32
hwbehrens wrote: post #7

This should not be a surprise, as this supports the NIST's revised recommendations (from June 2017!) that passwords should not expire [0], because it actually leads to less-secure passwords for this exact reason. Furthermore, many corporate systems do not integrate well with password managers, such as when first logging in to your system in the morning. This means that the password is likely to be one of the few that…

Bruce Schneier's summarization [0] of NIST's revised recommendations: 1. Stop it with the annoying password complexity rules. They make passwords harder to remember. They increase errors because artificially complex passwords are harder to type in. And they don't help that much. It's better to allow people to use pass phrases. 2. Stop it with password expiration. That was an old idea for an old way we used computers.…

Surely the whole point of a password manager is to have a different long complex password for each system you login to without needing to remember any of them but your master password?

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#230

Post by TheSpiceIsLife »

rorykoehler wrote: post #229
orand wrote: post #32

Earlier quoted context omitted.

Bruce Schneier's summarization [0] of NIST's revised recommendations: 1. Stop it with the annoying password complexity rules. They make passwords harder to remember. They increase errors because artificially complex passwords are harder to type in. And they don't help that much. It's better to allow people to use pass phrases. 2. Stop it with password expiration. That was an old idea for an old way we used computers.…

Surely the whole point of a password manager is to have a different long complex password for each system you login to without needing to remember any of them but your master password?

What part of the parent comment are you replying to?
Post reply on HN