Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

There’s no need to change passwords if they're robust, unique and not breached

tidbits.com

Post reply on HN
Print view View original

281–288 of 288 posts

Re: There’s no need to change passwords if they're robust, unique and not breached

#281

Post by iudqnolq »

joshvm wrote: post #280
iudqnolq wrote: post #278

Earlier quoted context omitted.

But if you actually tried to use 6 digits you'll discover most layers never tested it, including some of the most common point-of-sale systems and many ATMs not operated by your bank. Plus, tellers at your bank won't believe you.

My debit card in Switzerland came with a six digit pin - which was a surprise coming from the UK - and it works fine in other countries (Germany and Italy at least). But chip and pin is well known established in Europe so that's not too surprising.

Interesting - I should have qualified all that as US specific, I (stupidly) forgot you have debit card pins as well.

Re: There’s no need to change passwords if they're robust, unique and not breached

#282

Post by staticassertion »

sk5t wrote: post #277
staticassertion wrote: post #260

Earlier quoted context omitted.

> But anyone who has been in security for more than 1 month knows that regular password rotation has not been a recommendation for over 5 years. So optimistic. We just got dinged on this for SOC2 and I had to send over the so800-83b document that states as much.

SOC2 = infosec advice from junior accountants

I still think it's overly optimistic to say "everyone in infosec knows this". Most people in infosec don't know anything.

Re: There’s no need to change passwords if they're robust, unique and not breached

#283

Post by timbit42 »

seanw444 wrote: post #72
UltraViolence wrote: post #44

I use Password Safe, an open-source password database. I highly recommend it for people that are more computer savvy. For the digital illiterates OnePass may be more suitable.

KeePassXC is also a great open-source password manager.

I've used both and KeePassXC is clunkier, requiring more clicks to get your un/pw.

PasswordSafe was designed by Bruce Schneier.

Re: There’s no need to change passwords if they're robust, unique and not breached

#284

Post by tatersolid »

hyperman1 wrote: post #163
dylan604 wrote: post #93

Earlier quoted context omitted.

If you do not reuse passwords and one of them does leak, then the only thing affected is the site/service that was compromised. Hence the word "unique" in the title.

Scenario: Your device has a keylogger. It already happened that e.g. android device makers were overly aggressive in debug logging almost everything, including everything you type or paste on the clipboard. Leaking a password on your side is an unknown unknown, so password rotation is not a bad practice on its own for a security conscious person: It limits a leak in time. Mandatory password rotation is a whole differ…

If your old password was compromised by a keylogger, your newly rotated password will be too.

There original threat model for forced password rotation was supposedly based on hash cracking time. This is a stupid threat model; the guy from NIST who wrote it back in the 80s admitted it was based on no research but was added arbitrarily because it sounded good at the time.

Re: There’s no need to change passwords if they're robust, unique and not breached

#285

Post by redbar0n »

bborud wrote: post #256
redbar0n wrote: post #182

How do you know if the password has been breached? More than not, you don’t. Hence, change password rutinely. That’s the logic, I presume.

You don't; except in a very limited sense if you use tools that check your passwords regularly against password leaks. But that still doesn't mean forced regular password rotation makes you safer. Changing your password is in itself a relatively high risk activity. And the likelihood of your password leaking tends to be dependent on factors you control. For instance, if you assume that a given service provider won't…

> And the likelihood of your password leaking tends to be dependent on factors you control.

Do you mean if you reuse the same password(s)?

> But that still doesn't mean forced regular password rotation makes you safer.

Would you say that even for people who use a password mamager and generate their passwords?

Re: There’s no need to change passwords if they're robust, unique and not breached

#286

Post by vel0city »

KennyBlanken wrote: post #107
jihadjihad wrote: post #76

Earlier quoted context omitted.

I know it's hard to imagine, but before we all held supercomputers in our pockets we all used to have dozens of ten-digit numbers memorized. I still remember my grade school friends' phone numbers.

You didn't memorize ten random digits. Area code, exchange, four digit extension is six things... Area code was likely all the same, maybe 2-3 tops, and associated both with the following exchange and geography, and used extensively. Exchange, also likely all the same, maybe 6 at most, and again likely associated with geography.

On top of that, in many areas in the US the time between moving to ten-digit dialing and the time of cell phones becoming even somewhat popular is really only a few years or less. Some places in the US are only finally being forced to move to ten digit dialing with some places still supporting seven digit dialing.

https://www.kcbd.com/2021/10/12/new-10-digit-dialing-procedu...

Note the date on this: Oct 2021!

> Starting on Monday, October 25, 2021, Texans with phone numbers in the 254, 361, 409, 806, 830, 915 and 940 area codes must dial 10-digits (area code + telephone number) for all local calls.

Re: There’s no need to change passwords if they're robust, unique and not breached

#287

Post by vel0city »

karaterobot wrote: post #179
adventured wrote: post #84

Earlier quoted context omitted.

You were an extreme outlier if you bothered to memorize dozens of ten digit phone numbers in the era before everyone had a cellphone. The average person doesn't even have ten good friends, much less a need to memorize dozens of phone numbers. They would buy address books / contact books to write down dozens of numbers, not memorize numbers they very rarely use.

I think "dozens" is an overstatement, but 10-20 wasn't unusual. In college, I could have given you the number for a dozen delivery restaurants, easily. Not proud of it, just saying. That's not counting family, friends, services like taxi companies and movie theaters, and work.

How many different area codes did those dozen delivery restaurants and taxi companies have? How many different exchanges? Was each one a unique area code, each a unique exchange? If not, then you're not really remembering unique 10 digit numbers. There's going to be a lot of repeated numbers in there.

Re: There’s no need to change passwords if they're robust, unique and not breached

#288

Post by whoomp12342 »

ReactiveJelly wrote: post #71
suifbwish wrote: post #26

Earlier quoted context omitted.

I am very curious why public private key auth is not a thing for websites and applications. I would rather have a single password to the server that publicly hosts my public key then I can simply point websites and applications to that address during signup. Every app/site would check the server every 5-20 mins for changes to my public key in case I need to change it. Then I can use my private key to authenticate to…

Because storage media can be shared and lost. If you're logging in from a library computer, you don't want the hassle of putting your privkey file on it and wiping it later. (Or connecting a USB drive, which may be a security hazard for the library) If you lose your computer, you still remember your password, but your only copy of your privkey may be lost. Losing hard drives is common for non-power users, because the…

cloud/vaults for all
Post reply on HN