49% of workers, forced to change passwords, reuse same one with minor change

My workplace does this (every month). Everyone just appends a number. Either the current month, or one they write on a post-it on their desk.

Hey Apple, etc

Whats with the 32 char limit? Are you storing my password in plaintext? Why are passwords even limited in length?

Warm regards, Some guy who prefers passphrases and is sick of dinky little passowrds

Guessing that it's English words is no harder than guessing that it's random uppercase/lowercase/numbers. So that part cancels out. Realistically you'd try all simple patterns in order of complexity. This makes cracking slower than knowing the pattern up front, but the password is already getting exponentially harder to crack every time it gets longer. The small factor of trying different simple patterns pales in comparison.

The attacker doesn't need to know how many words. They would try 1, then 2, then 3, etc.

Capitalization and tiny modifications are only worth a few bits. They can't get you anywhere near the quality of 32 random alphanumerics.

Your password example is a lot stronger. But even then I don't know if it's better than a full 32 random characters. That would mean every two characters in your password have more randomness than a completely random character with no patterns. That might be true.

Reminds me of the first job of my career.

We had a 30-day password reset policy enforced by Active Directory group policy. I couldn't have told you what rules were required to get the system to accept the password, but it well beyond the default/typical AD policy[0]. To "enhance security", ours included a requirement that none of the prior 10-or-so passwords could be used, had a 12-character minimum[1] which IIRC, required also setting the "Store passwords using reversible encryption[2]". We allowed 30 bad logins, but a good login had to occur before lock-out or it required tech staff intervention.

We would have been better off having a non-resetting password policy with a reasonable minimum length. For the first 9 months of my career, I was top-tier end-user support[3]. It took about 2-months before I stopped asking people for passwords. 95% of the time, the password was "MonthNameYearNumber!!!!" with bangs filling in the rest, i.e. "March19991!!!!!!!!", or some variation. However, the frequency with which it was exactly that pattern was amazing. So that gave me 12 tries to get a password. I rarely locked out an account.

As is usually the case ... there's a law of unintended consequences. People will seek to reduce the friction to getting their job done and aren't great at assessing risk. In addition, the risk to an individual password is low. Even the result of a successful breach of a user's password is often not devastating to the individual who was attacked when that password is a LAN login (chances are you're not storing your own personal financial information on your work PC).

One of the odder unintended consequences -- figuring out the appropritae incantation to generate an acceptable password for the system was ... way more difficult than it should have been. I'm fairly certain one of our security tools was just broken. We had something that applied far more strict rules about password history than what AD could enforce, looking specifically for people using patterns, along with some other odd ones, like "you cannot repeat the same character", so "umbreLLa" was rejected. They, literally, reduced the number of possible passwords that a brute-force attack would require.

There was an interesting bug there -- we discovered that after the account was created, if only one password was in the password history, it would pretty much refuse to allow any password that didn't contain half of the characters, in the same place, as the prior password. Then, future required password resets would refuse all passwords that were similar to the previously rejected ones which were used on that account. However, if you used one of those rejected passwords on an account that hadn't had them rejected on that first reset, they would be allowed for that user.

I'm guessing they reversed a boolean somewhere (no similar past passwords) and that the security software stored a history of rejected passwords for future validation (no idea why this would be done, but then, no idea why it'd be illegal to duplicate characters), but security ditched all of those products when AD was upgraded and the tools stopped working. I know one of the reasons for the odd password rules were that we synced passwords to the Mainframe accounts, and they had a set of nonsensical rules that were very similar.

[0] If memory serves, default was 10 bad passwords before 1 hour lock-out, password had to have at least one number, one lower-case and one upper-case letter with an 8-character maximum and 90-day reset.

[1] I believe there's a study or two that indicates somewhere around 7-10 is typical for what a person can memorize easily. I've always wondered why. In my childhood, memorizing a 7-digit or 10-digit phone number for several people was something everyone did, so it's arguable that people my age have that ability out of necessity. I wonder what would be found if that were re-done, today, with people who are too young to remember days before speed-dial. Maybe it has been: https://abcnews.go.com/Technology/brain-memory-magic-number/...

[2] This sounds horrifying when thinking about passwords in today's terms, but storing as a password hash resulted in storing a Lan Manager Password hash which is very low quality (fairly certain this is moderately improved in later versions of AD but is still able to be enabled).

[3] I remember joking that we were helpdesk staff without phones; our "ticket system" was voicemail/e-mail. Basically, if the helpdesk couldn't solve it over the phone, we arrived at a cubicle, often with a screw-driver.

edit: bumped tab and accidentally hit "enter" for a newline ... submitting before I was done :(

> At what point would they exhaust their bruteforce capability or decide that they've probably got the wrong pattern and go for another one?

Go in increasing order of difficulty. Or estimated rarity based off of password dumps.

Something like: One character, two characters, one word, one word plus a character, one character plus a word, one modified word, three characters, etc.

"word" being a list of most common words in the united states, or something. Like you said, using many languages screws up dictionary attacks. But most passwords don't do that.

> I hope the next pattern they choose isn't one to four random English dictionary words followed by the number of letters in the resulting phrase, expressed in binary using X for 1 and Y for 0!

That would just be "four words plus five random characters".