There’s no need to change passwords if they're robust, unique and not breached

Post by [deleted] » Fri, Mar 04, 2022, 10:01 PM UTC

missingrib wrote: post #249

Sohcahtoa82 wrote: post #215

Earlier quoted context omitted.

> Automated password rotation would use machine generated highly secure passwords. Which will result in two things: 1. LOTS of calls to IT from forgotten passwords 2. People writing their passwords down on sticky notes.

I don't really see the issue with people writing their passwords down on sticky notes.

Post by [deleted] » Fri, Mar 04, 2022, 10:07 PM UTC

tomp wrote: post #257

iso1631 wrote: post #58

Earlier quoted context omitted.

Vast majority of passwords will have just 1 symbol, either at the start or end, or replace A with @, S with $, etc P@55w0rd! Is an awful password, yet meets many security policies P@ssword2, P@ssword3, P@ssword4 etc Also meet them, and rotate just fine. Meanwhile dadbffc67f798e8e0b7441fb995aeabe Is perfectly fine, but often is not allowed

I end passwords with "1Aa" or "1Aa," to appease all these random requirements. Don't worry, the first 10 letters are randomly generated a-z or a-z0-9.

Post by jazzyjackson » Fri, Mar 04, 2022, 10:11 PM UTC

bachmeier wrote: post #42

the_snooze wrote: post #31

Earlier quoted context omitted.

The "character class" requirement really doesn't add much security. And the "password rotation" policy can actually result in worse passwords than otherwise. Those measures were effectively just folk medicine from the days when the threat was thought to be someone manually trying to brute-force your password at your terminal.

> The "character class" requirement really doesn't add much security. If you're generating your passwords randomly (using a password manager) it actually reduces security because it reduces the set of acceptable passwords.

Post by ozim » Fri, Mar 04, 2022, 10:21 PM UTC

the_snooze wrote: post #252

ozim wrote: post #241

Earlier quoted context omitted.

The problem is how do you know that your password was not leaked or stolen? You don't know and that your brokerage did not ask you - it can mean anything, they might have had a breach already but they kept it secret. Idea about rotation of passwords is that you assume that your password 'was leaked/cracked' and you don't know about it and have no way knowing it.

>Idea about rotation of passwords is that you assume that your password 'was leaked/cracked' and you don't know about it and have no way knowing it. That's really not the user's responsibility at that point. It's up to the service to store passwords securely (i.e., use proper password hashing functions) and monitor login behavior to throw up extra challenges if things look suspicious. Password rotation is a high-cost…

Post by snow_mac » Fri, Mar 04, 2022, 10:23 PM UTC

cogman10 wrote: post #254

johncessna wrote: post #193

Earlier quoted context omitted.

Most of these policies boil down to regulations or compliance. The financial industry, ironically, is a huge propagator of antiquated security controls. We all knew that the controls were bad, but we had to use them

As a fellow person in finance... yuuuup. We switch passwords every 6 months and it is super annoying. A LOT of my coworkers are doing `password1` then `password2` which... sort of completely defeats the purpose of the policy.