Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password expiration is dead, long live passwords

techcrunch.com

Post reply on HN
Print view View original

231–240 of 316 posts

Re: Password expiration is dead, long live passwords

#231

Post by captn3m0 »

msravi wrote: post #204
mattowen_uk wrote: post #184

Shifting from passwords to more secure systems such as MFA ignores the elephant in the room about passwords that no-one wants to acknowledge: People share passwords. A simple example is this: A couple do online grocery shopping every week or so, depending who has time to do it, one them will log into the 'account' and build the basket. Maybe the other will then amend the basket a few hours later before the cut off ti…

I don't know, but (at least some of) the apps that need multiple logins for precisely the scenario you suggest, seem to have solved this. Here in India we have some grocery apps that deliver (mainly perishables) every morning, such as Doodhwala ( https://play.google.com/store/apps/details?id=com.bangertech... ) and MilkBasket ( https://play.google.com/store/apps/details?id=com.milkbasket... ). So I register with my p…

Only OTP login is not MFA

Re: Password expiration is dead, long live passwords

#232

Post by kkarakk »

kebman wrote: post #205
kkarakk wrote: post #171

Earlier quoted context omitted.

hmmm good way to get users to become heated with your customer support. i've implemented this feature and had the CEO of the company come down 15 floors and tell me personally to revert the change for him coz it was getting confusing for him to remember passwords. Everyone else in the company also demanded it once wind of this request spread... This was the middle east, and yes they refused to use password manager pr…

It is largely agreed that Israel won the Arab-Israeli war because their NCO's on the ground were given much more leeway to make tactical decisions of their own. This was in start contrast to the top-heavy and often bureaucratic tactical decision making of the Arab League. Why am I mentioning this? Well, if you are an army leader, and you know that your soldiers in general have an IQ score of around 82; would you let…

I don't work in the middle east anymore for a reason...there is no changing some things until there is leadership from the top

Re: Password expiration is dead, long live passwords

#234

Post by oedmarap »

When signing into Office 365's admin portal for the first time, "Set passwords to never expire" is actually the first and only wizard-type suggestion that's presented as a best practice to get out of the way.

It's a nice reminder and the option is already pre-selected so you just have to click Save. I've gotten into the habit of doing this now even before configuring domains, users, etc.

The next logical step of course is to enable/enforce MFA for all users as a thorough auth policy.

Re: Password expiration is dead, long live passwords

#235

Post by aerique »

karrotwaltz wrote: post #193
Freak_NL wrote: post #178

Earlier quoted context omitted.

Always a joy when your generated password is refused: 694*C73&4:Ekp>fy>SE&o![RC (This is an example of what password-store generates.) Not good enough, because it's too long. Nothing throws you back ten years in time like having to handcraft a password to comply with all the silly rules.

Not so long ago I had to register to a website allowing a comma (or was it a semicolon?) in a password during registration but refusing to login using said password. Fun times.

Hm, yes. I had that happen with a '#'. Presumably there was some nasty evaluation going on and the rest of the password was treated as a comment.

I wonder why I never pursued that.

Re: Password expiration is dead, long live passwords

#236

Post by loonyphoenix »

tomglynch wrote: post #213
loonyphoenix wrote: post #210

Earlier quoted context omitted.

That relies on every website implementing this solution, and I don't think such coordination is possible. Also I don't see the advantage over just server-side hashing. Client-side hashing (without a password manager) is public, so the salt the site uses is known.

Well any website serious about security - yes. But if a single website decides to do it it would work fine. It would be quite easy to just add a js file with this. For example this one for the Stanford JS Crypto Library: https://github.com/bitwiseshiftleft/sjcl/blob/master/core/sh... We're currently putting the onus on the end user (who are mostly apathetic), when really the onus should be on the websites.

How would protecting a single website help? If the password is shared among different sites, and one of the sites turns out to be malicious, I'll be able to access your single website just fine by typing the sniffed password into your textbox, whereupon it can use however much hashing and encryption as it wants and it won't help.

Re: Password expiration is dead, long live passwords

#237

Post by aerique »

vinay_ys wrote: post #160
paulryanrogers wrote: post #43

Earlier quoted context omitted.

Some never memorize their passwords at all. Instead relying on 'forgot' emails and "Remember Me" features entirely.

In India, most mobile apps have phone number for username and OTP instead of password. Makes perfect sense for mobile apps. Except when OTP doesn't arrive due to congested sms networks. Or that your account gets hacked with sim takeover or sms MitM (both are currently unheard of in India).

I think you just jinxed it.

Re: Password expiration is dead, long live passwords

#238

Post by kebman »

dTal wrote: post #220
kebman wrote: post #198

Earlier quoted context omitted.

You will usually get far better entropy by simply stitching together a random array of everyday words. Example: stitching better everyday words array entropy level. Anyway, as for the too-long problem, then I guess we're back to square one. :)

Good try, but that doesn't apply to password managers. Several everyday words contain more bits than a garbled single word, but a string of dozens of truly random characters beat both. You might be referring to https://xkcd.com/936/

That's the one! ^^ And you're of course correct.

Re: Password expiration is dead, long live passwords

#239

Post by tolien »

andrewaylett wrote: post #208
tolien wrote: post #201

Earlier quoted context omitted.

Do laypeople know or care about the details of password hashing too, and if not does it matter if they know what TOTP stands for? “Scan this barcode then enter the six digit number from the app; we’ll sometimes ask for the number when you log in” isn’t particularly onerous - 1Password for example will insert your one time pass along with your password so in some cases there isn’t even an extra step to log in. I’d be…

If your TOTP key is stored in the same place as your password, is it still in any sense a second factor?

That argument surely holds if you’ve got Google Authenticator and 1Password installed on the same device?

If someone gets your vault password and can unlock your phone, you’re toast, but SMS as a second factor is then also compromised so what usable (since this thread started as trying to sell MFA to lay people) options do you have (other than maybe a Yubikey)?

Re: Password expiration is dead, long live passwords

#240

Post by Freak_NL »

thameera wrote: post #226
karrotwaltz wrote: post #193

Earlier quoted context omitted.

Not so long ago I had to register to a website allowing a comma (or was it a semicolon?) in a password during registration but refusing to login using said password. Fun times.

I once spent 15 minutes trying to register in a local Domino's website which kept bugging me about lack of a special character - even though I had one in it. Turned out to be that the app truncates the entered password after the first 20 characters and only considers the first part. Thankfully the special character was after the 20th position so I noticed the error and fixed it, but if it wasn't I'd be wondering the…

You might not even have noticed if the login form truncated the input as well before hashing it. (You probably would have noticed after some update to their website removes the truncation though.)
Post reply on HN