Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password expiration is dead, long live passwords

techcrunch.com

Post reply on HN
Print view View original

241–250 of 316 posts

Re: Password expiration is dead, long live passwords

#241

Post by tomglynch »

infogulch wrote: post #133
pstch wrote: post #63

Earlier quoted context omitted.

I don't see how TOTP/2FA can avoid the problem of user password re-use. The password has still been reused, whether an extra layer of authentication is used or not. Maybe you can say that it mitigates it, but I don't think it avoids it at all.

There are two slightly overlapping ways to actually solve this problem: 1. Use a password manager. 2. Have the tools, knowledge, capability, and willingness to use secure passphrases.

One other way. Websites could hash and salt the users password client side, then proceed as usual (SSL and hash it server side). Means the users password is effectively a long, secure passphrase and is unique. What do you think?

Re: Password expiration is dead, long live passwords

#242

Post by stephenr »

tomglynch wrote: post #202
stephenr wrote: post #166

Earlier quoted context omitted.

I don't think the comment you replied to was referring to checking a "current" password. It's about checking a "new" password when an account is created, or the password changed. Having said that - I don't see any issue with checking current passwords when the user logs in - you don't send the password to the remote service, so it can't leak that way.

Yeah I know - checking a new password is worse! Turns out he's downloaded a hashed list and is checking against that. Which is fine.

The “regular” api works on a hash of the first handful of characters - in no scenario do you send the actual password to a remote service, so what is your concern?

Re: Password expiration is dead, long live passwords

#243

Post by msravi »

captn3m0 wrote: post #231
msravi wrote: post #204

Earlier quoted context omitted.

I don't know, but (at least some of) the apps that need multiple logins for precisely the scenario you suggest, seem to have solved this. Here in India we have some grocery apps that deliver (mainly perishables) every morning, such as Doodhwala ( https://play.google.com/store/apps/details?id=com.bangertech... ) and MilkBasket ( https://play.google.com/store/apps/details?id=com.milkbasket... ). So I register with my p…

Only OTP login is not MFA

Well no, it isn't. But there's really nothing stopping the OTP from being the 2nd factor, and we're still not tied to a single device.

Re: Password expiration is dead, long live passwords

#244

Post by raesene9 »

pstch wrote: post #63
rtempaccount1 wrote: post #38

Earlier quoted context omitted.

TOTP or other forms of 2FA are the best way of avoiding the very real problem of user password re-use.

I don't see how TOTP/2FA can avoid the problem of user password re-use. The password has still been reused, whether an extra layer of authentication is used or not. Maybe you can say that it mitigates it, but I don't think it avoids it at all.

I'd say it avoids it, mitigates would work fine.

The sum of the authentication credentials passed to the application is different for each site. with 2FA you submit password + token. so an attacker who is replaying compromised credentials can't gain unauthorised access with them alone.

Re: Password expiration is dead, long live passwords

#245

Post by scarface74 »

kavi87 wrote: post #162
malaysanghi wrote: post #159

Earlier quoted context omitted.

I would think anyone enforcing password expiration would make sure the password is sufficiently (subjective) different from current password. This should be simple to enforce by asking for current password when you are asking for new password. You can perform a text match before computing whatever hash you need to store.

You'll need to store passwords in clear for this, not a good idea.

Even if you don’t want users last 10 passwords to be “similar” (by whatever your definition of similar is), you can still hash the similar variants when you hash the original and check them.

I’m not saying whether this is a good idea or not. I haven’t thought through it.

Re: Password expiration is dead, long live passwords

#246

Post by jsymolon »

rahoulb wrote: post #222
reaperducer wrote: post #148

Earlier quoted context omitted.

A couple of years ago one of my banks "upgraded" its web site, forcing me to change my password to comply with its revised password guidelines since my old password was no longer permitted. The result was a password that was shorter, less varied, and less secure than the previous one. Good job, Chase.

I had a similar problem with Lloyds - every time I wanted to transfer money using the mobile app, I had to type in the password manually as they had disabled the "paste" option. Given my password was auto-generated and 16 characters long - and the password field wiped every time I did an app-switch, I just gave up.

"Don't Fuck With Paste"

http://browserengine.net/dont-fuck-with-paste-for-chrome-and...

Re: Password expiration is dead, long live passwords

#247

Post by scarface74 »

deadbunny wrote: post #216
jsonau wrote: post #79

Another worst offender are security questions to unlock accounts. Answers to these questions are usually visible to customer service reps and similar set of questions are asked among different services. This is scary. It's dangerous as having password stored in plain text as answers to the security questions can potentially unlock many other accounts. I highly suggest everyone answers each of them with a unique answe…

I recently closed a bank account I opened purely to take advantage of their decent interest. After draining both accounts online I then called up to close them, the first question was "Who is your favorite superhero?" I blanked, no idea, I set these accounts up like 2 years ago. No problem they just set me up some new "security" questions after confirming my name/address/dob. Suffice to say I'm glad they're not holdi…

My bank uses the mobile app as 2FA when you call in. You first have to login to your mobile app and then have to verify it. That alleviates the stolen phone number issue.

Re: Password expiration is dead, long live passwords

#248

Post by amelius »

mattowen_uk wrote: post #184

Shifting from passwords to more secure systems such as MFA ignores the elephant in the room about passwords that no-one wants to acknowledge: People share passwords. A simple example is this: A couple do online grocery shopping every week or so, depending who has time to do it, one them will log into the 'account' and build the basket. Maybe the other will then amend the basket a few hours later before the cut off ti…

> Shifting from passwords to more secure systems such as MFA ignores the elephant in the room about passwords that no-one wants to acknowledge: People share passwords.

In real life, people share keys too. So in some cases the "key" should probably be the metaphor, and it could be implemented by a dongle.

Re: Password expiration is dead, long live passwords

#249

Post by funnybeam »

discreditable wrote: post #72
technion wrote: post #56

Earlier quoted context omitted.

Microsoft has a pwnedpasswords-like service you can use: https://docs.microsoft.com/en-us/azure/active-directory/auth...

* If you use Azure Active Directory

On-premises AD has the same functionality but it is a pain to set up and so limited as to be not worth the effort

Re: Password expiration is dead, long live passwords

#250

Post by testvox »

tolien wrote: post #239
andrewaylett wrote: post #208

Earlier quoted context omitted.

If your TOTP key is stored in the same place as your password, is it still in any sense a second factor?

That argument surely holds if you’ve got Google Authenticator and 1Password installed on the same device? If someone gets your vault password and can unlock your phone, you’re toast, but SMS as a second factor is then also compromised so what usable (since this thread started as trying to sell MFA to lay people) options do you have (other than maybe a Yubikey)?

I thought Yubikeys and other hardware keys were best practice?
Post reply on HN