Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password expiration is dead, long live passwords

techcrunch.com

Post reply on HN
Print view View original

281–290 of 316 posts

Re: Password expiration is dead, long live passwords

#281

Post by throw0101a »

Veen wrote: post #225
kebman wrote: post #198

Earlier quoted context omitted.

You will usually get far better entropy by simply stitching together a random array of everyday words. Example: stitching better everyday words array entropy level. Anyway, as for the too-long problem, then I guess we're back to square one. :)

Strings of everyday words are better than the passwords most people choose, they're memorable, and they're often good enough from a practical perspective. But if you're using a password manager and don't have to remember passwords, you might as well use truly random passwords, which have more entropy.

> [...] you might as well use truly random passwords, which have more entropy.

At what point is more entropy simply diminishing returns? Five random words gives you 64 bits, and six gives you 77 bits (each word = 12.9 bites):

* https://en.wikipedia.org/wiki/Diceware * https://www.rempe.us/diceware/#eff

Re: Password expiration is dead, long live passwords

#282

Post by npongratz »

JoeAltmaier wrote: post #256

Not sure expiration is the worst problem with passwords. In no particular order, * Most are easy to remember (most of us don't use LastPass etc) * They authenticate the user but not the service! * They're leaky (the system tells you when you have the wrong one, facilitating several kinds of attacks) * People leave them lying around all the time * Changing one almost always involves using the old one (instead of start…

> * Forget about usernames. The password becomes an 'account key' and is all you need

When talking about your account, then -- such as when talking to Support -- how would you refer to your account? Would you be assigned an ID by the system, which you then have to save or remember?

Not saying it's good or bad or anything, just want to understand the expected user experience.

Re: Password expiration is dead, long live passwords

#283

Post by JoeAltmaier »

npongratz wrote: post #282
JoeAltmaier wrote: post #256

Not sure expiration is the worst problem with passwords. In no particular order, * Most are easy to remember (most of us don't use LastPass etc) * They authenticate the user but not the service! * They're leaky (the system tells you when you have the wrong one, facilitating several kinds of attacks) * People leave them lying around all the time * Changing one almost always involves using the old one (instead of start…

> * Forget about usernames. The password becomes an 'account key' and is all you need When talking about your account, then -- such as when talking to Support -- how would you refer to your account? Would you be assigned an ID by the system, which you then have to save or remember? Not saying it's good or bad or anything, just want to understand the expected user experience.

Any amount of profile information can be associated with an account. But a better, more secure technique than describing the account, would be to create a temporary token for the account and share it with support. That proves you're authorized to ask support to make changes in that account.

Re: Password expiration is dead, long live passwords

#284

Post by dspillett »

reaperducer wrote: post #148
Aeolun wrote: post #143

Earlier quoted context omitted.

Also not helped by the fact that passwords have to include every symbol and their mother, cannot include sequential digits, cannot include sequential letters, cannot include any letter of your name, and a bunch of other inane rules that could be changed to simply having a minimum length of 12 instead of 8...

A couple of years ago one of my banks "upgraded" its web site, forcing me to change my password to comply with its revised password guidelines since my old password was no longer permitted. The result was a password that was shorter, less varied, and less secure than the previous one. Good job, Chase.

FirstDirect's "digital secure key" Android app, which allows me (or someone else who happens to get hold of my phone while it is unlocked) to transfer a few grand out pretty easily, limits passwords to "between 6 and 9 characters". And offers fingerprint based auth as an alternative, because we all know how infallibly secure that method is.

Re: Password expiration is dead, long live passwords

#285

Post by bjnord »

Aeolun wrote: post #147
dcow wrote: post #7

Earlier quoted context omitted.

I did some lunch table math a few weeks ago. Assuming it takes on average 30 min for an employee to rotate a password (reboots, re-logins, etc.), assuming an average $50/hr across all employees, ~600k employees @ 4 changes per year (my current company policy is ever 80-ish days) = $60MM of human time spent per year making the company less secure .

It doesn’t take 30 minutes to change my password from ‘password5’ to ‘password6’ though.

You're assuming it works. Where I work we have an intranet-based web app that pushes the new password to all the various corporate systems. We're forced to choose a new password every 90 days. I'd say 1 time out of 3 something doesn't work, and I have to open a support ticket. While I'm waiting for support, I'm not getting emails, or can't log in to some systems, etc. Multiply that by hundreds of users at my company.

Twice, support resolved the issue by resetting my password and telling me the new one... which is my last name plus 4 digits. Then I can live with a very insecure password for 90 days, or try the reset app roulette again.

Re: Password expiration is dead, long live passwords

#286

Post by falcor84 »

The article recommends LastPass but ironically LastPass still asks you to change the master passphrase every 180 days. I've complained about this a long time ago and they didn't seem to take my request seriously despite my sending them links to the NIST recommendations.

Re: Password expiration is dead, long live passwords

#287

Post by enriquto »

Shaddox wrote: post #279
enriquto wrote: post #172

Can't we say good riddance to all passwords yet? I yearn for the day where I can log-in everywhere using public key cryptography.

Not yet, I'm afraid. Passwords are the best of the bad solutions people came up with. For public key cryptography, the problem remains, as always, key exchange. How can one be sure you are who you say you are?

But this only concerns the first usage. Once a public key has been acknowledged there is never further need for a password. It is only you who has the private key.

Re: Password expiration is dead, long live passwords

#288

Post by afiori »

Raistael wrote: post #48
afiori wrote: post #34

Earlier quoted context omitted.

> it's often the only way to ensure that the end user actually updates their password regularly It is fair to point out that the relevance of this is dependent on your attack model. If you suspect someone is trying to crack your password then just a longer password is fine. If you suspect a leak then you actually need to change/update password.

This is largely true, but we also exist in a day and age where computing clusters can fire off billions of guesses per second. Anything less than 16 digits takes a questionably small amount of time in comparison, when paired with some of the more advanced attack vectors.

This is the wrong argument here. With regards to brute force attacks changing password is only relevant if the attack time is comparable to the password turnover. If it takes one week to crack a simple password but you only change it every six month then you have ~1/24 chance to actually increase the attack time.

Re: Password expiration is dead, long live passwords

#289

Post by traydee »

falcor84 wrote: post #286

The article recommends LastPass but ironically LastPass still asks you to change the master passphrase every 180 days. I've complained about this a long time ago and they didn't seem to take my request seriously despite my sending them links to the NIST recommendations.

I've been using lastpass for 6+ years now and its never asked me to change my master passphrase, let alone every 180 days.

Re: Password expiration is dead, long live passwords

#290

Post by traydee »

Forbo wrote: post #152
cortesoft wrote: post #132

Earlier quoted context omitted.

PCI certification requires passwords to be rotated every 90 days.

Now that NIST is on board with long lived passwords, I really hope the next iteration of PCI follows suit.

NIST has been recomending this for 3+ years now. The question is how long will it take for PCI to pick up on it?
Post reply on HN