Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

There’s no need to change passwords if they're robust, unique and not breached

tidbits.com

Post reply on HN
Print view View original

271–280 of 288 posts

Re: There’s no need to change passwords if they're robust, unique and not breached

#271

Post by snow_mac »

sgustard wrote: post #166
Beached wrote: post #123

I feel like this post was intended to inflame or shock the reader with the writers stance on password policy. But anyone who has been in security for more than 1 month knows that regular password rotation has not been a recommendation for over 5 years. Both NIST, and MS have been trying to get the world to move to long, never rotated password, so long as those passwords are dictionary checked. Every company (all 3 of…

Every company I work at requires regular rotation and other idiotic rules which lead people to choose demonstrably weaker passwords. My company refuses to listen to reason and accuses us of trying to subvert security when we point out their antiquated process. What do you recommend?

This is why things like MarchPassword2022! comes about ... not that I've ever used that password...

Re: There’s no need to change passwords if they're robust, unique and not breached

#272

Post by spicybright »

jandrese wrote: post #233
thejerz wrote: post #100

> There’s no need to change passwords if they're robust, unique and not breached This assumes you'll know if passwords were exposed in a breach. Some breaches go undetected.

This also assumes that changing the password would effectively lock out attackers that have already breached your systems.

It's vastly more likely you'll be pwned by remote passwords than local programs. Even if it is a local program, there's so many ways to store a password there's no automated way to reliably get a password. Your threat model will become a person targeting you specifically, thumbing through your files to find information, etc.

Re: There’s no need to change passwords if they're robust, unique and not breached

#273

Post by benhurmarcel »

sgustard wrote: post #166
Beached wrote: post #123

I feel like this post was intended to inflame or shock the reader with the writers stance on password policy. But anyone who has been in security for more than 1 month knows that regular password rotation has not been a recommendation for over 5 years. Both NIST, and MS have been trying to get the world to move to long, never rotated password, so long as those passwords are dictionary checked. Every company (all 3 of…

Every company I work at requires regular rotation and other idiotic rules which lead people to choose demonstrably weaker passwords. My company refuses to listen to reason and accuses us of trying to subvert security when we point out their antiquated process. What do you recommend?

> What do you recommend?

Increment a digit at the end of your password and stick the current digit on a post-it below your monitor, like everyone does. Then get on with real work.

Re: There’s no need to change passwords if they're robust, unique and not breached

#274

Post by benhurmarcel »

ozim wrote: post #242
orthecreedence wrote: post #224

Earlier quoted context omitted.

2password 3password 4password ... >=]

https://en.wikipedia.org/wiki/Levenshtein_distance Anything below 5 in distance gets rejected, try again, please. While you get to change password you make 2 boxes with current and new of course and do your comparisons on it, just to explain you still keep passwords hashed.

password01january

password02february

password03march

...

Re: There’s no need to change passwords if they're robust, unique and not breached

#275

Post by illiac786 »

sdoering wrote: post #248
lmkg wrote: post #194

Earlier quoted context omitted.

I worked at a small consultancy. We started without password rotation requirements, because it's more secure. We had to add them, because our clients' legal teams started requiring that their contracts with vendors mandate industry-standard security practices. Your employer was probably in a similar situation: certain practices are mandated by customer contracts, not actual security assessments. It takes a long time…

I know. TiSAX (automotive industry requirements standard) forces much of this onto us (just to name one example). And if I am not mistaken even ISO27001 requires this to be compliant/certified.

Nope: https://github.com/dwyl/ISO-27001-2013-information-technolog...

Re: There’s no need to change passwords if they're robust, unique and not breached

#277

Post by sk5t »

staticassertion wrote: post #260
Beached wrote: post #123

I feel like this post was intended to inflame or shock the reader with the writers stance on password policy. But anyone who has been in security for more than 1 month knows that regular password rotation has not been a recommendation for over 5 years. Both NIST, and MS have been trying to get the world to move to long, never rotated password, so long as those passwords are dictionary checked. Every company (all 3 of…

> But anyone who has been in security for more than 1 month knows that regular password rotation has not been a recommendation for over 5 years. So optimistic. We just got dinged on this for SOC2 and I had to send over the so800-83b document that states as much.

SOC2 = infosec advice from junior accountants

Re: There’s no need to change passwords if they're robust, unique and not breached

#278

Post by iudqnolq »

joshvm wrote: post #244
seanw444 wrote: post #63

Earlier quoted context omitted.

That provides one million possibilities. I don't think you're missing anything. That's pretty terrible. The only thing prolonging your account at that point is the service's rate-limiting, assuming a naive "enter this password in the login field, try it, repeat."

Rate limiting can be practically strong for everyday use. Bank PINs are commonly 4 digits, though the chip+PIN system allows up to at least 6. Three attempts and the card is locked. Provided you stop users from picking obvious numbers like birthdays, it's pretty effective at preventing card fraud. Weak passwords can be fine, provided rate limiting is extremely aggressive. You can adjust this based on access e.g. your…

But if you actually tried to use 6 digits you'll discover most layers never tested it, including some of the most common point-of-sale systems and many ATMs not operated by your bank. Plus, tellers at your bank won't believe you.

Re: There’s no need to change passwords if they're robust, unique and not breached

#279

Post by igetspam »

ozim wrote: post #234
lmkg wrote: post #194

Earlier quoted context omitted.

I worked at a small consultancy. We started without password rotation requirements, because it's more secure. We had to add them, because our clients' legal teams started requiring that their contracts with vendors mandate industry-standard security practices. Your employer was probably in a similar situation: certain practices are mandated by customer contracts, not actual security assessments. It takes a long time…

Second that, we get some corporate checklist from the customer and they want it green. Explaining that it is not industry standard anymore takes time and if they want to take time of their employees using our system to deal with that, I am not wasting our company time to make them right.

I've had customers ask and question me about it. I write the policies and reference the relevant NIST guidelines. It's a good way to end those conversations quickly. Even fed compliance generally won't argue.

Re: There’s no need to change passwords if they're robust, unique and not breached

#280

Post by joshvm »

iudqnolq wrote: post #278
joshvm wrote: post #244

Earlier quoted context omitted.

Rate limiting can be practically strong for everyday use. Bank PINs are commonly 4 digits, though the chip+PIN system allows up to at least 6. Three attempts and the card is locked. Provided you stop users from picking obvious numbers like birthdays, it's pretty effective at preventing card fraud. Weak passwords can be fine, provided rate limiting is extremely aggressive. You can adjust this based on access e.g. your…

But if you actually tried to use 6 digits you'll discover most layers never tested it, including some of the most common point-of-sale systems and many ATMs not operated by your bank. Plus, tellers at your bank won't believe you.

My debit card in Switzerland came with a six digit pin - which was a surprise coming from the UK - and it works fine in other countries (Germany and Italy at least). But chip and pin is well known established in Europe so that's not too surprising.
Post reply on HN