Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password expiration is dead, long live passwords

techcrunch.com

Post reply on HN
Print view View original

261–270 of 316 posts

Re: Password expiration is dead, long live passwords

#261

Post by bluGill »

snarf21 wrote: post #255
mattowen_uk wrote: post #184

Shifting from passwords to more secure systems such as MFA ignores the elephant in the room about passwords that no-one wants to acknowledge: People share passwords. A simple example is this: A couple do online grocery shopping every week or so, depending who has time to do it, one them will log into the 'account' and build the basket. Maybe the other will then amend the basket a few hours later before the cut off ti…

MFA does not mean no sharing. It is trivial to setup up multiple credentials for the same account. You can easily have two different fingerprints setup as 2FA from two different devices for the same account. Most services let you have backup codes and dongles already. This is mostly an issue of education. We already see a lot of these kinds of other factors like sending a message to device 1 when provisioning device…

In theory you are correct. In practice very few systems are set up so that two different people can share an account without using a shared password.

Re: Password expiration is dead, long live passwords

#263

Post by bluGill »

thameera wrote: post #227
rahoulb wrote: post #222

Earlier quoted context omitted.

I had a similar problem with Lloyds - every time I wanted to transfer money using the mobile app, I had to type in the password manually as they had disabled the "paste" option. Given my password was auto-generated and 16 characters long - and the password field wiped every time I did an app-switch, I just gave up.

It's very disturbing to see that your worst passwords are for your bank accounts. Each bank I've worked with has some weird limitation like this. Not to forget that the only form of MFA that most banks allow is SMS - assuming they even offer MFA.

Banks are probably still running on the old mainframe (old as in upgraded in 1998 when y2k forced it), with password storage that was state of the art in 1960 (plain text, but the file is actually protected well so hackers can't get it). That isn't to say better password cannot be used, just that they have never enabled it.

Re: Password expiration is dead, long live passwords

#265

Post by kurtisc »

redthrow wrote: post #67
rtempaccount1 wrote: post #42

Earlier quoted context omitted.

Actually most security professionals have a serious downer on writing passwords down. I can see some circumstances where it could make sense, as you say where physical security concerns are less of an issue. That said I wouldn't say a 2FA device is like a post-it note really. Assuming you're thinking about TOTP like google authenticator, access to the codes is protected by the devices' security, which adds a bit more…

For example Bruce Schneier recommends writing down the password and keeping it in a relatively safe place like the wallet (where people keep other sensitive information like credit card numbers). https://www.schneier.com/blog/archives/2005/06/write_down_yo... I don't think anyone recommends writing down the password on a post-it note and put it on the computer screen at work.

Even then, if it's an OS password (drive encryption n/inc) and they have physical access to the disks containing assets then it's already game over.

Re: Password expiration is dead, long live passwords

#266

Post by nkrisc »

lowkeyokay wrote: post #177
erichurkman wrote: post #99

Earlier quoted context omitted.

Slack does this exceptionally well. If you forget which accounts you have, you can put in an email address and it will email you a list of your Slack accounts. If you forget your password, you can get a magic link that automatically signs in through a deep link into the app, no password needed.

But Slack then must rely on the security of your email. If the site is dealing with sensitive information like credit cards, this could be a no go.

What email based log in that doesn't use 2FA doesn't ultimately rely on the security of your email?

Re: Password expiration is dead, long live passwords

#267

Post by SketchySeaBeast »

karrotwaltz wrote: post #193
Freak_NL wrote: post #178

Earlier quoted context omitted.

Always a joy when your generated password is refused: 694*C73&4:Ekp>fy>SE&o![RC (This is an example of what password-store generates.) Not good enough, because it's too long. Nothing throws you back ten years in time like having to handcraft a password to comply with all the silly rules.

Not so long ago I had to register to a website allowing a comma (or was it a semicolon?) in a password during registration but refusing to login using said password. Fun times.

I've had that with work passwords - using my password generator I give them a 64-character gibberish mess, but it turns out that they only accept 16 characters, and I rendered my account useless until they could reset it for me. How frustrating.

Re: Password expiration is dead, long live passwords

#268

Post by asdff »

malaysanghi wrote: post #159
lysp wrote: post #146

Earlier quoted context omitted.

The problem with having a short expiration is that it forces people to simply use their password with a count: password1, password2, ... password23, password24. This means that if you discover someone's current password, you also have their future 10+ passwords as well.

I would think anyone enforcing password expiration would make sure the password is sufficiently (subjective) different from current password. This should be simple to enforce by asking for current password when you are asking for new password. You can perform a text match before computing whatever hash you need to store.

You'd be surprised. At my uni of 50k students the running joke was you'd just add 1 to your password every six months.

Re: Password expiration is dead, long live passwords

#269

Post by SketchySeaBeast »

kurtisc wrote: post #254
thameera wrote: post #226

Earlier quoted context omitted.

I once spent 15 minutes trying to register in a local Domino's website which kept bugging me about lack of a special character - even though I had one in it. Turned out to be that the app truncates the entered password after the first 20 characters and only considers the first part. Thankfully the special character was after the 20th position so I noticed the error and fixed it, but if it wasn't I'd be wondering the…

Why do you need a secure account to order pizza?

How else are they going to run pepperoni-based big data analytics?

Re: Password expiration is dead, long live passwords

#270

Post by SketchySeaBeast »

bluGill wrote: post #263
thameera wrote: post #227

Earlier quoted context omitted.

It's very disturbing to see that your worst passwords are for your bank accounts. Each bank I've worked with has some weird limitation like this. Not to forget that the only form of MFA that most banks allow is SMS - assuming they even offer MFA.

Banks are probably still running on the old mainframe (old as in upgraded in 1998 when y2k forced it), with password storage that was state of the art in 1960 (plain text, but the file is actually protected well so hackers can't get it). That isn't to say better password cannot be used, just that they have never enabled it.

I don't understand that - I get that the system that holds the data is old, but when creating an online banking system shouldn't the piece that holds the data be a good half dozen steps removed from the website and authentication?
Post reply on HN