Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Frequent reauth doesn't make you more secure

tailscale.com

Post reply on HN
Print view View original

261–270 of 539 posts

Re: Frequent reauth doesn't make you more secure

#261

Post by dcow »

thousand_nights wrote: post #218
montebicyclelo wrote: post #189

Forced password rotation and expiry seems the bigger problem; given that it causes people to get locked out so often, (e.g. if pw expires when on holiday), — often then requiring travelling to IT, or at least a few hours trying to get IT on the phone to reset, or chasing up colleagues who aren't locked out to get in touch with IT. Many (most?) companies still do it, despite it now not being recommended by NIST: > Ver…

if my password has not been leaked it's insane that providers think i should rotate it, but this still seems to be standard practice for some completely baffling reason

There’s weird math that says your password or generally a secret key is more secure if it’s existed for less time (generated fresh) because there hasn’t been as much time to brute force it. I don’t believe it but some hardcore types do.

Re: Frequent reauth doesn't make you more secure

#262

Post by sakesun »

free652 wrote: post #257
montebicyclelo wrote: post #189

Forced password rotation and expiry seems the bigger problem; given that it causes people to get locked out so often, (e.g. if pw expires when on holiday), — often then requiring travelling to IT, or at least a few hours trying to get IT on the phone to reset, or chasing up colleagues who aren't locked out to get in touch with IT. Many (most?) companies still do it, despite it now not being recommended by NIST: > Ver…

Jesus, it was so annoying so I kept appending a letter after each password reset -> a through z thankfully my current company let me keep my password for the last 3 years

Password similarity rule was not enforced ?

Re: Frequent reauth doesn't make you more secure

#263

Post by dcow »

princevegeta89 wrote: post #36

I hate Apple products for this. I see this pattern across all apple products - not one. On my mac, I setup my touch ID, and log in to my Apple account on the App Store. Time and again, when I try to install apps, it keeps repeatedly prompting for my password, instead of letting me just use my touchID. This applies to free apps as well, which is again silly beyond what is already enough silliness. I briefly see this o…

Something is mis-configured. This isn't the default experience. TouchID works just fine for AppStore purchases.

Re: Frequent reauth doesn't make you more secure

#264

Post by benlivengood »

dcow wrote: post #261
thousand_nights wrote: post #218

Earlier quoted context omitted.

if my password has not been leaked it's insane that providers think i should rotate it, but this still seems to be standard practice for some completely baffling reason

There’s weird math that says your password or generally a secret key is more secure if it’s existed for less time (generated fresh) because there hasn’t been as much time to brute force it. I don’t believe it but some hardcore types do.

That might apply to short passwords but passphrases are recommended and if they're >20 characters then brute forcing is not going to make meaningful progress toward them while we are all alive.

Re: Frequent reauth doesn't make you more secure

#265

Post by TylerE »

kevincox wrote: post #195
TylerE wrote: post #180

Earlier quoted context omitted.

I’ve kind of become a fan of the sites that don’t even have passwords but just email you a “magic” link. If my account security is tied to my email why make me do extra song and dance if I’m gonna have to fish out an email for every login anyway?

I despise this. With username and password my password manager just fills it in and it is one click to click "login". With email magic link I need to enter my email (it seems to rarely auto-fill for some reason), then wait (often it takes 10s for the email to be sent for some reason), then if I was logging in on something that isn't my default browser I need to copy+paste the link (often just clicking the link author…

My point is that on sites that force email 2FA you have to do the email dance anyway. A username and password are basically theater.

Re: Frequent reauth doesn't make you more secure

#266

Post by wycy »

tharkun__ wrote: post #255
xp84 wrote: post #214

Earlier quoted context omitted.

Password rotation does nothing more than get you to use 1234abcd@ 1234abcd@1 1234abcd@2 1234abcd@3 I'm becoming pretty convinced that at least in the corporate space, we'd be way better off with a required 30 character minimum password, with the only rules being against gross repetition or sequences. (no a * 30 or abcd...yz1234567890 ). Teach people to use passphrases and work on absolutely minimizing the number of t…

Don't tell them. I don't want to have to enter 30 characters. And it does not help for the people you'd need it for anyway. 1234567890a1234567890@1234567890 Better? No, just longer to type. You can't fix stupid people by making the life of non-stupid people worse. All you do is for non-stupid people to stop caring and do the easiest thing possible too.

Correct-horse-battery-staple!! is 30 characters and quick to type

Re: Frequent reauth doesn't make you more secure

#267

Post by MrDrMcCoy »

tharkun__ wrote: post #255
xp84 wrote: post #214

Earlier quoted context omitted.

Password rotation does nothing more than get you to use 1234abcd@ 1234abcd@1 1234abcd@2 1234abcd@3 I'm becoming pretty convinced that at least in the corporate space, we'd be way better off with a required 30 character minimum password, with the only rules being against gross repetition or sequences. (no a * 30 or abcd...yz1234567890 ). Teach people to use passphrases and work on absolutely minimizing the number of t…

Don't tell them. I don't want to have to enter 30 characters. And it does not help for the people you'd need it for anyway. 1234567890a1234567890@1234567890 Better? No, just longer to type. You can't fix stupid people by making the life of non-stupid people worse. All you do is for non-stupid people to stop caring and do the easiest thing possible too.

That's why we recommend passphrases. That 30 character requirement becomes much easier when it's 3-4 words with a separater. Faster to type, too.

Re: Frequent reauth doesn't make you more secure

#268

Post by wycy »

thyristan wrote: post #83
paxys wrote: post #41

Earlier quoted context omitted.

And it's even worse if you are accessing Apple services on a non-Apple device. No matter how many times I click "trust device" when logging in to icloud.com it will still make me do the password + one-time code song and dance the next day. Another pointless annoyance - if Face ID fails when making a payment or installing an app (like it frequently does for reasons like sleeping in bed or wearing sunglasses) it won't…

Microsoft crap is similarly broken. After each and every login there is the question whether it should remember me and whether it should ask that question again. It doesn't matter at all what you answewr there, it changes absolutely nothing.

I wonder how many millions of productivity hours have been lost due to millions of people having to click through these stupid, useless prompts countless times per day.

Re: Frequent reauth doesn't make you more secure

#269

Post by kevincox »

TylerE wrote: post #265
kevincox wrote: post #195

Earlier quoted context omitted.

I despise this. With username and password my password manager just fills it in and it is one click to click "login". With email magic link I need to enter my email (it seems to rarely auto-fill for some reason), then wait (often it takes 10s for the email to be sent for some reason), then if I was logging in on something that isn't my default browser I need to copy+paste the link (often just clicking the link author…

My point is that on sites that force email 2FA you have to do the email dance anyway. A username and password are basically theater.

That's true. Although pasting the code into the existing browser tab is a bit smoother in my workflow. And at least the form autofills properly when they ask for email and password.

I'd much prefer if they could just trust my password. But I know the unfortunate truth is that the majory of people just reuse a password across most sites. So these measures are intended to raise the baseline difficulty, not to improve the security of those with good habits.

Re: Frequent reauth doesn't make you more secure

#270

Post by SAI_Peregrinus »

montebicyclelo wrote: post #189

Forced password rotation and expiry seems the bigger problem; given that it causes people to get locked out so often, (e.g. if pw expires when on holiday), — often then requiring travelling to IT, or at least a few hours trying to get IT on the phone to reset, or chasing up colleagues who aren't locked out to get in touch with IT. Many (most?) companies still do it, despite it now not being recommended by NIST: > Ver…

Does anyone not add the year & month of the last password change to the end of their password? E.g. PascalCasePassphraseGoesHere2025-06, then at the next required change in (for example) 6 months: PascalCasePassphraseGoesHere2026-01. It almost certainly fits the inane "letter, number, and special character" requirements they probably have, complies with "different from your last X passwords", and is easy to keep track of the change interval. It also adds no security whatsoever! A user could almost certainly get away with Password2025-06, etc.
Post reply on HN