Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

There’s no need to change passwords if they're robust, unique and not breached

tidbits.com

Post reply on HN
Print view View original

241–250 of 288 posts

Re: There’s no need to change passwords if they're robust, unique and not breached

#241

Post by ozim »

ejb999 wrote: post #20

I am in the camp of requiring people to have strong passwords, and not requiring them to be changed - ever. When you ask people to remember too many passwords, they start writing them down and/or forgetting them, which leads to other problems. My oldest online account - btw it is a brokerage account at one of the big brokerage houses, where a great deal of my cash and investments sit - has not asked me to change the…

The problem is how do you know that your password was not leaked or stolen?

You don't know and that your brokerage did not ask you - it can mean anything, they might have had a breach already but they kept it secret.

Idea about rotation of passwords is that you assume that your password 'was leaked/cracked' and you don't know about it and have no way knowing it.

Re: There’s no need to change passwords if they're robust, unique and not breached

#242

Post by ozim »

orthecreedence wrote: post #224
jrodthree24 wrote: post #154

Earlier quoted context omitted.

My company just fixed this. By requiring you to change your password by more than the last character. Really cutting edge security here.

2password 3password 4password ... >=]

https://en.wikipedia.org/wiki/Levenshtein_distance

Anything below 5 in distance gets rejected, try again, please.

While you get to change password you make 2 boxes with current and new of course and do your comparisons on it, just to explain you still keep passwords hashed.

Re: There’s no need to change passwords if they're robust, unique and not breached

#243

Post by spc476 »

sgustard wrote: post #166
Beached wrote: post #123

I feel like this post was intended to inflame or shock the reader with the writers stance on password policy. But anyone who has been in security for more than 1 month knows that regular password rotation has not been a recommendation for over 5 years. Both NIST, and MS have been trying to get the world to move to long, never rotated password, so long as those passwords are dictionary checked. Every company (all 3 of…

Every company I work at requires regular rotation and other idiotic rules which lead people to choose demonstrably weaker passwords. My company refuses to listen to reason and accuses us of trying to subvert security when we point out their antiquated process. What do you recommend?

Try quoting from the government standard, NIST Special Publication 800-63b, section 5.1.1.2, which states: “Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically).”

Re: There’s no need to change passwords if they're robust, unique and not breached

#244

Post by joshvm »

seanw444 wrote: post #63
Darmody wrote: post #24

Earlier quoted context omitted.

6 characters and entirely numeric seems like a bad idea, or am I missing something?

That provides one million possibilities. I don't think you're missing anything. That's pretty terrible. The only thing prolonging your account at that point is the service's rate-limiting, assuming a naive "enter this password in the login field, try it, repeat."

Rate limiting can be practically strong for everyday use. Bank PINs are commonly 4 digits, though the chip+PIN system allows up to at least 6. Three attempts and the card is locked. Provided you stop users from picking obvious numbers like birthdays, it's pretty effective at preventing card fraud.

Weak passwords can be fine, provided rate limiting is extremely aggressive. You can adjust this based on access e.g. your admin account might be locked under stricter heuristics like a single attempted login outside your geographic region (Live mail does this to me sometimes). In this case the user might even have the correct password, but if something else doesn't add up then you can block.

Re: There’s no need to change passwords if they're robust, unique and not breached

#245

Post by ozim »

PopAlongKid wrote: post #203
0xbadcafebee wrote: post #102

So, really, you should change a password regularly if: - The password is weak - It is ever reused - Anyone else has access to it - You use it on a device you don't control - You use it on a device which might be running malware and can intercept it - It was stored insecurely

>Anyone else has access to it While sharing passwords is never a good idea, sometimes it is necessary. For example, I am the treasurer of a non-profit organization, an elected position that rotates every two years. We have a savings account at a credit union that for a variety of reasons requires online access by multiple individuals who change over time. The only way to keep this even a little secure over time is to…

That is totally reasonable scheme if amount of people with access is restricted to something like 5 and you always know when someone drops off.

Re: There’s no need to change passwords if they're robust, unique and not breached

#246

Post by ozim »

Havoc wrote: post #198

>and not breached Bit of an ideal conditions assumption. If security isn’t breached then you by definition don’t have a security issue

That is why changing password gained popularity, one has to assume password was breached.

You might never know if operator lost your pw.

Re: There’s no need to change passwords if they're robust, unique and not breached

#247

Post by coder543 »

hyperman1 wrote: post #163
dylan604 wrote: post #93

Earlier quoted context omitted.

If you do not reuse passwords and one of them does leak, then the only thing affected is the site/service that was compromised. Hence the word "unique" in the title.

Scenario: Your device has a keylogger. It already happened that e.g. android device makers were overly aggressive in debug logging almost everything, including everything you type or paste on the clipboard. Leaking a password on your side is an unknown unknown, so password rotation is not a bad practice on its own for a security conscious person: It limits a leak in time. Mandatory password rotation is a whole differ…

I think it's also worth pointing out that there are many reasons why 2FA is valuable. Even if someone ends up with your password, they would still need your second factor, which could be a TOTP token or a WebAuthn device like a YubiKey.

Even if you rotated your password frequently, there would still be a large window of compromise. Password rotation only helps with very strange attack scenarios, and passwords themselves aren't really good enough for anything where security actually matters.

I would personally push away from passwords on the whole at this point. SSO is probably more secure for most users. Plenty of websites only support username+password auth, and given how bad most passwords are... I might even go so far as to suggest that username+TOTP is instantly more secure than that, especially with proper rate limiting as you should have anyways. (Yes, I know TOTP is "supposed" to only be a second factor.)

WebAuthn takes this to the next level and promises a future where you can use a strong single factor to log in, without any opportunity for phishing or credential compromise... but most implementations I've seen still require a fallback password mechanism. There are understandable reasons for this right now, but it is unfortunate.

Re: There’s no need to change passwords if they're robust, unique and not breached

#248

Post by sdoering »

lmkg wrote: post #194
sdoering wrote: post #131

Earlier quoted context omitted.

Working at a acquisition of a big consulting corporation. Had these recommendations in place before being acquired. We're onboarded onto better security systems by new mothership. Password rotation every 75 days. No dictionary check. No check against known breached passwords. No real reasonable rules against insecure passwords (like ac_Paul2022 is valid 'secure' password). Additional massive "spyware" on corporate de…

I worked at a small consultancy. We started without password rotation requirements, because it's more secure. We had to add them, because our clients' legal teams started requiring that their contracts with vendors mandate industry-standard security practices. Your employer was probably in a similar situation: certain practices are mandated by customer contracts, not actual security assessments. It takes a long time…

I know. TiSAX (automotive industry requirements standard) forces much of this onto us (just to name one example).

And if I am not mistaken even ISO27001 requires this to be compliant/certified.

Re: There’s no need to change passwords if they're robust, unique and not breached

#249

Post by missingrib »

Sohcahtoa82 wrote: post #215
nixpulvis wrote: post #191

Earlier quoted context omitted.

Automated password rotation would use machine generated highly secure passwords. I do not see your point. This issue for master passwords is a bit harder, yes.

> Automated password rotation would use machine generated highly secure passwords. Which will result in two things: 1. LOTS of calls to IT from forgotten passwords 2. People writing their passwords down on sticky notes.

I don't really see the issue with people writing their passwords down on sticky notes.

Re: There’s no need to change passwords if they're robust, unique and not breached

#250

Post by majkinetor »

Brian_K_White wrote: post #97

One missed point, the advice is even slightly better than they argue, since they only argue that it's not necessary to change it, which is just an argument of convenience. But updating a password is itself an attack surface. More so than merely using it to log in. It's one of the times where an attacker may be tricking you into giving it to them, either by a fake page or app dialog, or in concert with maybe they have…

Or key logger
Post reply on HN