Password expiration is dead, long live passwords • Hacker News Board

Re: Password expiration is dead, long live passwords

#31

Post by gowld » Sun, Jun 02, 2019, 9:34 PM UTC

jaabe wrote: post #16

We’re required to have password expiration by law in the public sector of Denmark. So I’m sure we’ll continue to have it for at least some years to come. I must admit I never really understood the function of it. Obviously lifetime access is more damaging than 3 months access, but the truly devastating thing is the unauthorised access itself not the length of it. Also the policy results in really bad practices like p…

Writing passwords on paper is recommended by security professionals, in the common case where your physical security is far more trustworthy than your digit security, because it supports the use of long, strong password. A 2FA device is very similar to a Post-It note.

Re: Password expiration is dead, long live passwords

#32

Post by jupp0r » Sun, Jun 02, 2019, 9:35 PM UTC

jeremyjh wrote: post #17

discreditable wrote: post #12

I still expire passwords on a yearly basis for the sole reason that users have complained to me that it stops them from using the password they use for everything else.

I came here to say this. I can't think of another way to guarantee that they aren't using the same password that they use on every website they've visited since 1997. If anyone has suggestions on this I'd love to hear it.

Not sure about the legality of this, but trying to log in to a a couple of services would be an easy test.

Re: Password expiration is dead, long live passwords

#33

Post by gowld » Sun, Jun 02, 2019, 9:36 PM UTC

LeoPanthera wrote: post #20

jaabe wrote: post #16

We’re required to have password expiration by law in the public sector of Denmark. So I’m sure we’ll continue to have it for at least some years to come. I must admit I never really understood the function of it. Obviously lifetime access is more damaging than 3 months access, but the truly devastating thing is the unauthorised access itself not the length of it. Also the policy results in really bad practices like p…

I briefly worked at a place that enforced quarterly password changes and I literally used as my password. I am not good at remembering passwords and I don't think I'm that unusual. Writing them down seemed worse than using a poor password that I can at least remember. Probably these days if forced I would use . I don't know how much better that is. But luckily now I work for myself.

Writing down is much better than using a guessable password. Your physical location is more secure than a password in a rainbow table

Re: Password expiration is dead, long live passwords

#34

Post by afiori » Sun, Jun 02, 2019, 9:39 PM UTC

Raistael wrote: post #10

FlorianRappl wrote: post #6

Earlier quoted context omitted.

Reality is that a password expiration policy quite often leads to password simplification (e.g., having an incremented number in the password, post its on the screen, ...). I'd prefer 2FA and (allowing / encouraging) longer / stronger passwords over change policies.

I prefer these methods as well, but password simplification is a user choice, not a causal effect. Any secure password generator and vault, keyfobs and various other methods are great ways to compensate for a password that expires every so often. While I'm not entirely in line with the idea of "forced" password expiration, it's often the only way to ensure that the end user actually updates their password regularly.…

> it's often the only way to ensure that the end user actually updates their password regularly

It is fair to point out that the relevance of this is dependent on your attack model. If you suspect someone is trying to crack your password then just a longer password is fine. If you suspect a leak then you actually need to change/update password.

Re: Password expiration is dead, long live passwords

#35

Post by CrowFly » Sun, Jun 02, 2019, 9:41 PM UTC

dessant wrote: post #24

That's exciting news, though it will take a couple of years until it trickles down to financial institutions. My bank forces me to change passwords every 3 months, and of course they also disable pasting for added security. We also have a local utility that sends you a 5 letter password upon account creation through email, and that's your password. If you try to change it, they'll send you another 5 letter one.

I have 2 and 3 year CDs in a bunch of banks. (This is a common use case, people open separate accounts because of the FDIC insurance limit in any one bank). I only need to log in again 2 or 3 years after opening the account to either take the money out, or open another CD.

Some of these banks expire passwords every 6 months! That's insane. I have calendar reminders set to remind me to log in and generate another password with LastPass.

Re: Password expiration is dead, long live passwords

#36

Post by omh » Sun, Jun 02, 2019, 9:42 PM UTC

blr246 wrote: post #4

The other part of this story I did not see mentioned is that I suspect that password expiration also makes organizations more vulnerable to social engineering hacks because legitimate users (I have done this) become locked out due to poorly managed password expiration, then have to call in to restore access. The use of insecure identity and authentication mechanisms like student IDs and security questions is a recipe…

Unfortunately we still have to have similar authentication methods for other password resets. Users have an alarming tendency to forget their passwords after a week or two of holiday.

Re: Password expiration is dead, long live passwords

#37

Post by kissgyorgy » Sun, Jun 02, 2019, 9:47 PM UTC

This has known for years now, but unfortunately, takes a long time to change.

The other thing what I just read recently and mentioned in this article is about storing secrets in environment variables. That's not good either because every running code and subprocess can read it...

Re: Password expiration is dead, long live passwords

#38

Post by rtempaccount1 » Sun, Jun 02, 2019, 9:57 PM UTC

discreditable wrote: post #27

cjensen wrote: post #18

Earlier quoted context omitted.

That's amusing but... those same users are likely to be using just altering their passwords a little like "passwd1" "passwd2", etc. You aren't gaining anything.

I'm sure they are, but I think predictability is slightly less bad than being distributed across every single service they've ever used. There's only so much I can do about people not giving a crap.

TOTP or other forms of 2FA are the best way of avoiding the very real problem of user password re-use.

Re: Password expiration is dead, long live passwords

#39

Post by pwg » Sun, Jun 02, 2019, 9:58 PM UTC

dessant wrote: post #24

That's exciting news, though it will take a couple of years until it trickles down to financial institutions. My bank forces me to change passwords every 3 months, and of course they also disable pasting for added security. We also have a local utility that sends you a 5 letter password upon account creation through email, and that's your password. If you try to change it, they'll send you another 5 letter one.

> and of course they also disable pasting for added security.

With Firefox, you can set this about:config setting to false to give you back the ability to paste, even when sites try to block it:

dom.event.clipboardevents.enabled

Re: Password expiration is dead, long live passwords

#40

Post by godelski » Sun, Jun 02, 2019, 10:01 PM UTC

omh wrote: post #36

blr246 wrote: post #4

The other part of this story I did not see mentioned is that I suspect that password expiration also makes organizations more vulnerable to social engineering hacks because legitimate users (I have done this) become locked out due to poorly managed password expiration, then have to call in to restore access. The use of insecure identity and authentication mechanisms like student IDs and security questions is a recipe…

Unfortunately we still have to have similar authentication methods for other password resets. Users have an alarming tendency to forget their passwords after a week or two of holiday.

Honestly this just seems like there needs to be a better way. Maybe some multi-factor system that requires like a physical key and either a secret and/or some identifying thing.