Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

There’s no need to change passwords if they're robust, unique and not breached

tidbits.com

Post reply on HN
Print view View original

221–230 of 288 posts

Re: There’s no need to change passwords if they're robust, unique and not breached

#221

Post by tempnow987 »

PeterisP wrote: post #205
tempnow987 wrote: post #200

Earlier quoted context omitted.

Both password rotation and special char requirements (which often interferes with strong password generations because other systems don't support same character sets) are very much alive and well in govt contracting / vendor requirement land. Ie, they are still very very common. In a business when the password reset request rate gets high, it usually gets easier and easier to reset passwords. I worked with a govt sys…

That's why it's relevant that the NIST US government standards have changed in the last few years, and government agencies who are still requiring password rotation are not compliant and will have to remove that requirement.

That's the issue, not from what I've seen for some reason. Even recently the IRS was making life harder with tighter rotation periods.

But yes, that is the hope. I did push back somewhat on a local city system that went down this rediculous path (blocked password managers, hand type password only, crazy complexity requirements and rotation for a low risk system - think looking up a water bill).

Re: There’s no need to change passwords if they're robust, unique and not breached

#222

Post by watwut »

Beached wrote: post #123

I feel like this post was intended to inflame or shock the reader with the writers stance on password policy. But anyone who has been in security for more than 1 month knows that regular password rotation has not been a recommendation for over 5 years. Both NIST, and MS have been trying to get the world to move to long, never rotated password, so long as those passwords are dictionary checked. Every company (all 3 of…

We have a year or so old policy that established rotation and special characters. Because that ia what hired security company recommend.

Re: There’s no need to change passwords if they're robust, unique and not breached

#223

Post by mmis1000 »

thesuitonym wrote: post #25
andrey_utkin wrote: post #12

I am unconvinced. What about persistent password bruteforcing? Rate limits? OK, bruteforcing is happening within those rate limits. That's how the password rots - it becomes less of a secret as many values are tried. Key material rotation seems to be a sensible practice in general.

What you're saying is true, but you need to consider a regular office drone who doesn't care about security. If you require them to change the password every 90 days, you will end up with the majority of people having passwords like conS0t01, conS0t02, conS0t03... And not only will they have such weak passwords, they will boast about this to anyone who will listen, leading users to actually tell other people their pa…

And when it arrived at the point user themselves are confusing about "wait, is it end at 33 or 34?". They Will Write It Down On Post It. And you end up get the worst security situation you can get normally.

Re: There’s no need to change passwords if they're robust, unique and not breached

#224

Post by orthecreedence »

jrodthree24 wrote: post #154
Moodles wrote: post #37

A lot of users will simply change their passwords by appending a 1, 2, 3, etc. at the end. Presumably if old passwords did sour and become compromised then Hashcat would easily crack the minor tweak on the new password. To be fair to these companies, the reason they do passwords so terribly is because of such poor guidance and standards in the past. Even now NIST has SP 800-132 for guidance on generating a cryptograp…

My company just fixed this. By requiring you to change your password by more than the last character. Really cutting edge security here.

2password

3password

4password

...

>=]

Re: There’s no need to change passwords if they're robust, unique and not breached

#225

Post by Arnavion »

nixpulvis wrote: post #161
Beached wrote: post #123

I feel like this post was intended to inflame or shock the reader with the writers stance on password policy. But anyone who has been in security for more than 1 month knows that regular password rotation has not been a recommendation for over 5 years. Both NIST, and MS have been trying to get the world to move to long, never rotated password, so long as those passwords are dictionary checked. Every company (all 3 of…

Please do not group password rotation and special character restriction. One strengthens, the other weakens security. The only reason I can think that rotation would be a bad idea (aside from frustration, which is another very critical issue) is if users are not using strong passwords on each iteration. The solution is for a standard to emerge that incorporates rotation and (optionally random) password generation use…

If we're going to talk about hypotheticals where the whole world is able to switch to machine-generated passwords, I'd rather it switch to machine-generated asymmetric keys and leave the problem of breaches in the past.

Re: There’s no need to change passwords if they're robust, unique and not breached

#226

Post by ryandrake »

etskinner wrote: post #217
blakesterz wrote: post #201

Earlier quoted context omitted.

I remember reading a report a while back that said the LEAST frequently used characters are brackets { [ ] }

Seems like the reason for this is that a lot of places don't accept them as special characters. The exclamation mark (!) and hash (#) are almost guaranteed to be on the special character list, so people likely choose them out of habit.

I've always hated the term "special characters." If you are a non-technical user, it leaves a lot to the imagination.

1. What characters count as special? Does "special" mean non-alphanumeric? If so, just say that, don't say "special".

2. Among those, which ones will be accepted by your password system? Is \ acceptable? Will ™ be accepted? What about emoji (which evidently HN comment input doesn't seem to accept)?

Most password entry prompts do not answer either of these questions, so you have to either guess or just use ! or # and move on with your life.

Re: There’s no need to change passwords if they're robust, unique and not breached

#228

Post by jandrese »

IMHO almost all organizations have terrible password policies. There are only a few requirements for a good password:

1. The password must be difficult to the point of impossible for a computer to guess.

2. The password must be memorable enough that a person can create it once and then remember it a month later.

If you don't satisfy requirement #1 then it will be hacked with a GPU farm. If you don't satisfy requirement #2 then the users will undermine your security in a multitude of ways. Almost no corporate password policy attempts to address or even facilitate option #2. They don't even mention it! Many corporate password policies are actively hostile to option #2, requiring a bunch of stuff that's hard for people to remember but only reduce the search space for the computer farms attacking your leaked password database.

I like to use phrases made of things that sound like words, but aren't in the dictionary. Make them themed to be memorable. I call them Jabberwocky passwords. Were it not in famous poem a good password would be "mimsy were the Borogroves".

Re: There’s no need to change passwords if they're robust, unique and not breached

#229

Post by unixbane »

Beached wrote: post #123

I feel like this post was intended to inflame or shock the reader with the writers stance on password policy. But anyone who has been in security for more than 1 month knows that regular password rotation has not been a recommendation for over 5 years. Both NIST, and MS have been trying to get the world to move to long, never rotated password, so long as those passwords are dictionary checked. Every company (all 3 of…

Yeah should have pitched it against other modern attempts to fix UN*X braindamage like password hashing.

Re: There’s no need to change passwords if they're robust, unique and not breached

#230

Post by jandrese »

suifbwish wrote: post #26
whoomp12342 wrote: post #16

There is no need for passwords. Cant we figure out something better? its only been like 50 years.

I am very curious why public private key auth is not a thing for websites and applications. I would rather have a single password to the server that publicly hosts my public key then I can simply point websites and applications to that address during signup. Every app/site would check the server every 5-20 mins for changes to my public key in case I need to change it. Then I can use my private key to authenticate to…

You sit down at a public machine with no accessible ports. I hope you memorized your public key so you can type it in.
Post reply on HN