Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Frequent reauth doesn't make you more secure

tailscale.com

Post reply on HN
Print view View original

291–300 of 539 posts

Re: Frequent reauth doesn't make you more secure

#291

Post by pixl97 »

eru wrote: post #288
xp84 wrote: post #214

Earlier quoted context omitted.

Password rotation does nothing more than get you to use 1234abcd@ 1234abcd@1 1234abcd@2 1234abcd@3 I'm becoming pretty convinced that at least in the corporate space, we'd be way better off with a required 30 character minimum password, with the only rules being against gross repetition or sequences. (no a * 30 or abcd...yz1234567890 ). Teach people to use passphrases and work on absolutely minimizing the number of t…

There's one weird trick to get people to have strong passwords (even if you force rotation): don't allow them to pick their own passwords. Randomly generate the passwords for them.

Also don't allow them to copy paste the password. And especially don't allow them to use any kind of password wallet. They will really love you for this and you won't get an excessive number of calls to reset forgotten/lost passwords.

Re: Frequent reauth doesn't make you more secure

#292

Post by Retric »

xp84 wrote: post #237
Retric wrote: post #222

Earlier quoted context omitted.

I’m doubtful a 30 digit minimum password is a meaningful improvement over a 20 digit password here. Meanwhile actually typing in very long passwords adds up across a workday/year especially with mistakes.

I think if done right, typing that password should be more like a once a quarter exception rather than a daily occurrence. Granted - there are blockers to getting there. IDK why for example, macOS can't use Touch ID from a cold boot, that's stupid, at least when there haven't been too many failed attempts or anything.

Touch ID isn’t that secure. It’s fine for personal devices, but I wouldn’t trust it alone in a government or cooperate environment.

A ~1:50,000 error rate per finger added sounds fine, but lose a few laptops and have multiple valid fingerprints etc and the odds quickly look significantly worse. Or a janitor could end up trying to log into a significant number of machines etc.

Re: Frequent reauth doesn't make you more secure

#293

Post by medvezhenok »

lytedev wrote: post #283
sakesun wrote: post #262

Earlier quoted context omitted.

Password similarity rule was not enforced ?

Doesn't enforcing this require storing the password in cleartext somewhere, which is a much more dangerous concept to begin with?

It probably requires some sort of decreased security (if the password hash is truly slow & secure, it would be hard to enforce dissimilarity); but there might be other methods that leak less than cleartext (like salting and storing hashes of overlapping/separate n-grams from the previous password and checking for number of similar n-grams; etc). Or as another commenter suggested checking all passwords within edit distance 1 (though if you can do that, your password hashing algorithm is likely too fast).

Re: Frequent reauth doesn't make you more secure

#294

Post by tlogan »

Sure. All true. But PCI compliance requires 90-day password rotation which might not be required if you’re using multi-factor authentication (MFA). In other words, in the case of MFA, that requirement might be waived: and the operative word here is might.

So, if you’re pursuing PCI compliance people don’t rely on assumptions or conditional language like might. Certainty is key when dealing with compliance frameworks.

Re: Frequent reauth doesn't make you more secure

#295

Post by haiku2077 »

HeavenFox wrote: post #281
LordDragonfang wrote: post #42

There's supreme irony with Tailscale being the one posting this -- because one of my biggest annoyances with the service is that, afaict, there's no way to set up a device so that it never expires. I just had two devices - one of which was my main server - I was using it with require re-auth out of nowhere and break one of my workflows. If I had not already set up separate remote access to the server, it would have b…

Yes, and it's especially frustrating for tailscale, since when it signs you out on the server you are often not in a position to re-auth

Just disable key expiry for the machine in the admin console

Re: Frequent reauth doesn't make you more secure

#296

Post by Mtinie »

sakesun wrote: post #290
lytedev wrote: post #283

Earlier quoted context omitted.

Doesn't enforcing this require storing the password in cleartext somewhere, which is a much more dangerous concept to begin with?

Interesting perspective. Wonder why so many SaaS service currently enforce this.

Cargo culting.

Re: Frequent reauth doesn't make you more secure

#297

Post by deathanatos »

SAI_Peregrinus wrote: post #270
montebicyclelo wrote: post #189

Forced password rotation and expiry seems the bigger problem; given that it causes people to get locked out so often, (e.g. if pw expires when on holiday), — often then requiring travelling to IT, or at least a few hours trying to get IT on the phone to reset, or chasing up colleagues who aren't locked out to get in touch with IT. Many (most?) companies still do it, despite it now not being recommended by NIST: > Ver…

Does anyone not add the year & month of the last password change to the end of their password? E.g. PascalCasePassphraseGoesHere2025-06, then at the next required change in (for example) 6 months: PascalCasePassphraseGoesHere2026-01. It almost certainly fits the inane "letter, number, and special character" requirements they probably have, complies with "different from your last X passwords", and is easy to keep trac…

I just let the keyring roll a completely new password. For some reason, all of my employers do require this insanity, but not on the one password I have to actually type.

Re: Frequent reauth doesn't make you more secure

#298

Post by mooreds »

asveikau wrote: post #213
montebicyclelo wrote: post #189

Forced password rotation and expiry seems the bigger problem; given that it causes people to get locked out so often, (e.g. if pw expires when on holiday), — often then requiring travelling to IT, or at least a few hours trying to get IT on the phone to reset, or chasing up colleagues who aren't locked out to get in touch with IT. Many (most?) companies still do it, despite it now not being recommended by NIST: > Ver…

Sometimes when I log into a random website and I see a forced password reset, I wonder if it has been compromised, rather than setting a time-based expiry. If a site owner knows that certain accounts are part of a database breach or something, a reasonable step would be to force the users to change the password at next login.

Another common reason to do a force password reset is if they've moved authentication providers and were not able to bring their hashes along. Some providers don't allow for hash export (Cognito, Entra).

Re: Frequent reauth doesn't make you more secure

#299

Post by mooreds »

twodave wrote: post #63

The people who need to read these articles are the auditors. Until they change their expectations, the many businesses who have to pass audits are still going to be stuck doing a lot of things that are industry-standard but also very stupid. This is the case even for small businesses in certain fields where security audits are valued. We have at least half a dozen measures in place that we know aren't actually helpfu…

The auditors aren't writing the compliance guidelines, are they? Just enforcing them.

I'd say you want to send these articles to the people writing such guidelines.

What am I missing?

Re: Frequent reauth doesn't make you more secure

#300

Post by deathanatos »

dcow wrote: post #261
thousand_nights wrote: post #218

Earlier quoted context omitted.

if my password has not been leaked it's insane that providers think i should rotate it, but this still seems to be standard practice for some completely baffling reason

There’s weird math that says your password or generally a secret key is more secure if it’s existed for less time (generated fresh) because there hasn’t been as much time to brute force it. I don’t believe it but some hardcore types do.

> I don’t believe it but some hardcore types do.

… which is why the password has sufficient entropy such that it will take until the heat death of the universe to brute force it. We're 3 months closer to the heat death of the universe … oh no?

Post reply on HN