Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

There’s no need to change passwords if they're robust, unique and not breached

tidbits.com

Post reply on HN
Print view View original

251–260 of 288 posts

Re: There’s no need to change passwords if they're robust, unique and not breached

#251

Post by the_snooze »

the_arun wrote: post #138

> Unless there’s a security breach where it’s stored But how confidentally we know this. Hence, people periodically change password. Or am I missing something?

There are better mechanisms than password rotation to mitigate (even undetected) security breaches.

Password databases can and should be storing that data using proper hashing functions like Argon or bcrypt. Those are designed to be slow, so brute-forcing them even offline and in parallel becomes time-consuming. This increases the time between when a breach happens and when those passwords become useful to attackers. This gives the service more opportunity to detect the breach and force users to reset their passwords.

If attackers somehow obtain actual passwords before then, then the login system should be using risk-based authentication, where it throws additional challenges if the user appears to be logging in from a completely unexpected IP address or client.

Re: There’s no need to change passwords if they're robust, unique and not breached

#252

Post by the_snooze »

ozim wrote: post #241
ejb999 wrote: post #20

I am in the camp of requiring people to have strong passwords, and not requiring them to be changed - ever. When you ask people to remember too many passwords, they start writing them down and/or forgetting them, which leads to other problems. My oldest online account - btw it is a brokerage account at one of the big brokerage houses, where a great deal of my cash and investments sit - has not asked me to change the…

The problem is how do you know that your password was not leaked or stolen? You don't know and that your brokerage did not ask you - it can mean anything, they might have had a breach already but they kept it secret. Idea about rotation of passwords is that you assume that your password 'was leaked/cracked' and you don't know about it and have no way knowing it.

>Idea about rotation of passwords is that you assume that your password 'was leaked/cracked' and you don't know about it and have no way knowing it.

That's really not the user's responsibility at that point. It's up to the service to store passwords securely (i.e., use proper password hashing functions) and monitor login behavior to throw up extra challenges if things look suspicious.

Password rotation is a high-cost measure placed on the user that has little (even negative) benefit, especially when there are more effective alternatives the service is better-positioned to implement. Users cannot twist themselves into knots to make up for shitty service-side design decisions.

Re: There’s no need to change passwords if they're robust, unique and not breached

#253

Post by [deleted] »

jrodthree24 wrote: post #154
Moodles wrote: post #37

A lot of users will simply change their passwords by appending a 1, 2, 3, etc. at the end. Presumably if old passwords did sour and become compromised then Hashcat would easily crack the minor tweak on the new password. To be fair to these companies, the reason they do passwords so terribly is because of such poor guidance and standards in the past. Even now NIST has SP 800-132 for guidance on generating a cryptograp…

My company just fixed this. By requiring you to change your password by more than the last character. Really cutting edge security here.

[deleted]

Re: There’s no need to change passwords if they're robust, unique and not breached

#254

Post by cogman10 »

johncessna wrote: post #193
sdoering wrote: post #131

Earlier quoted context omitted.

Working at a acquisition of a big consulting corporation. Had these recommendations in place before being acquired. We're onboarded onto better security systems by new mothership. Password rotation every 75 days. No dictionary check. No check against known breached passwords. No real reasonable rules against insecure passwords (like ac_Paul2022 is valid 'secure' password). Additional massive "spyware" on corporate de…

Most of these policies boil down to regulations or compliance. The financial industry, ironically, is a huge propagator of antiquated security controls. We all knew that the controls were bad, but we had to use them

As a fellow person in finance... yuuuup. We switch passwords every 6 months and it is super annoying. A LOT of my coworkers are doing `password1` then `password2` which... sort of completely defeats the purpose of the policy.

Re: There’s no need to change passwords if they're robust, unique and not breached

#255

Post by pitaj »

sgustard wrote: post #166
Beached wrote: post #123

I feel like this post was intended to inflame or shock the reader with the writers stance on password policy. But anyone who has been in security for more than 1 month knows that regular password rotation has not been a recommendation for over 5 years. Both NIST, and MS have been trying to get the world to move to long, never rotated password, so long as those passwords are dictionary checked. Every company (all 3 of…

Every company I work at requires regular rotation and other idiotic rules which lead people to choose demonstrably weaker passwords. My company refuses to listen to reason and accuses us of trying to subvert security when we point out their antiquated process. What do you recommend?

My company is the same way. I've even quoted NiST recommendations, but they say that ISO standards require it. Ugh

Re: There’s no need to change passwords if they're robust, unique and not breached

#256

Post by bborud »

redbar0n wrote: post #182

How do you know if the password has been breached? More than not, you don’t. Hence, change password rutinely. That’s the logic, I presume.

You don't; except in a very limited sense if you use tools that check your passwords regularly against password leaks.

But that still doesn't mean forced regular password rotation makes you safer. Changing your password is in itself a relatively high risk activity. And the likelihood of your password leaking tends to be dependent on factors you control.

For instance, if you assume that a given service provider won't leak their password database (which is usually hashed in some way), you are being optimistic. You should always expect that this can happen and act accordingly when choosing, or preferably generating, a new password.

Re: There’s no need to change passwords if they're robust, unique and not breached

#257

Post by tomp »

iso1631 wrote: post #58
gspencley wrote: post #45

Earlier quoted context omitted.

You're probably right that, in practice, the character class doesn't automatically add security if the password is sufficiently strong and random. The theory is that by introducing special characters you're decreasing the likelihood of having characters that are commonly found together, thus decreasing the effectiveness of dictionary attacks. Of course modern dictionary algorithms will still look for characters that…

Vast majority of passwords will have just 1 symbol, either at the start or end, or replace A with @, S with $, etc P@55w0rd! Is an awful password, yet meets many security policies P@ssword2, P@ssword3, P@ssword4 etc Also meet them, and rotate just fine. Meanwhile dadbffc67f798e8e0b7441fb995aeabe Is perfectly fine, but often is not allowed

I end passwords with "1Aa" or "1Aa," to appease all these random requirements.

Don't worry, the first 10 letters are randomly generated a-z or a-z0-9.

Re: There’s no need to change passwords if they're robust, unique and not breached

#258

Post by brendoelfrendo »

bachmeier wrote: post #42
the_snooze wrote: post #31

Earlier quoted context omitted.

The "character class" requirement really doesn't add much security. And the "password rotation" policy can actually result in worse passwords than otherwise. Those measures were effectively just folk medicine from the days when the threat was thought to be someone manually trying to brute-force your password at your terminal.

> The "character class" requirement really doesn't add much security. If you're generating your passwords randomly (using a password manager) it actually reduces security because it reduces the set of acceptable passwords.

Requiring special characters also reduces the set of allowable passwords by eliminating all passwords that don’t contain at least one special character. The best practice for maximizing the set of acceptable passwords would be to allow, but not require, special characters (and to allow as many of them as possible, not the narrow subset of special characters applications often allow).

Re: There’s no need to change passwords if they're robust, unique and not breached

#259

Post by wrycoder »

cogman10 wrote: post #254
johncessna wrote: post #193

Earlier quoted context omitted.

Most of these policies boil down to regulations or compliance. The financial industry, ironically, is a huge propagator of antiquated security controls. We all knew that the controls were bad, but we had to use them

As a fellow person in finance... yuuuup. We switch passwords every 6 months and it is super annoying. A LOT of my coworkers are doing `password1` then `password2` which... sort of completely defeats the purpose of the policy.

r6N9P&vKjjgM r7N0P&vKjjgM etc

Re: There’s no need to change passwords if they're robust, unique and not breached

#260

Post by staticassertion »

Beached wrote: post #123

I feel like this post was intended to inflame or shock the reader with the writers stance on password policy. But anyone who has been in security for more than 1 month knows that regular password rotation has not been a recommendation for over 5 years. Both NIST, and MS have been trying to get the world to move to long, never rotated password, so long as those passwords are dictionary checked. Every company (all 3 of…

> But anyone who has been in security for more than 1 month knows that regular password rotation has not been a recommendation for over 5 years.

So optimistic. We just got dinged on this for SOC2 and I had to send over the so800-83b document that states as much.

Post reply on HN