Password expiration is dead, long live passwords • Hacker News Board

Re: Password expiration is dead, long live passwords

#301

Post by tracker1 » Mon, Jun 03, 2019, 6:02 PM UTC

altendo wrote: post #271

thameera wrote: post #226

Earlier quoted context omitted.

I once spent 15 minutes trying to register in a local Domino's website which kept bugging me about lack of a special character - even though I had one in it. Turned out to be that the app truncates the entered password after the first 20 characters and only considers the first part. Thankfully the special character was after the 20th position so I noticed the error and fixed it, but if it wasn't I'd be wondering the…

I've had the same problem with Verizon, in the past the password would only store the first 20 characters. Took me an hour or two to figure it out and fix the problem. I'm not sure if that's still the case, hopefully not.

My issue with Verizon is they lock an account after 3 bad attempts, and the "username" is the cell phone number for the account. Which seems to be slurped into some automated brute force engine.

Every single time I want to login, I have to do a password reset first. Makes me which I had the phone number to every manager in the company, so I could lock them all out every day.

Also, since having the phone is the only second factor for authentication, that's all you need to access an account.

Re: Password expiration is dead, long live passwords

#302

Post by tolien » Mon, Jun 03, 2019, 6:11 PM UTC

Natanael_L wrote: post #293

tolien wrote: post #273

Earlier quoted context omitted.

They might be a preference but I don’t see how they can be best practice when they’re barely supported on a lot of platforms - Firefox has some support (but doesn’t work with, for example, Github), no/limited support in Safari, no/limited support in mobile devices.

WebAuthn (previously U2F) is just now gaining that support and momentum, with support both in Firefox and Android

Oh for sure, and if Safari (including iOS) gets support we'll be golden across the board [1] whereas U2F was until recently pretty much Chrome-only [2]. It just can't happen soon enough!

1: https://caniuse.com/#feat=webauthn 2: https://caniuse.com/#feat=u2f

Re: Password expiration is dead, long live passwords

#303

Post by kissgyorgy » Mon, Jun 03, 2019, 6:32 PM UTC

noobermin wrote: post #65

kissgyorgy wrote: post #37

This has known for years now, but unfortunately, takes a long time to change. The other thing what I just read recently and mentioned in this article is about storing secrets in environment variables. That's not good either because every running code and subprocess can read it...

As an ignorant person who doesn't do multiuser anything, how is this a problem if you are sure you're the only user of a physical system? The moment my computer is compromised by anyone else I'd think all bets are off then.

A malicious third-party package (example: https://www.theregister.co.uk/2018/11/26/npm_repo_bitcoin_st...) could read well-known environment variables like AWS credentials or something. I don't understand why we didn't heard about this kind of attack yet :D

Re: Password expiration is dead, long live passwords

#304

Post by WorldMaker » Mon, Jun 03, 2019, 6:56 PM UTC

Sahhaese wrote: post #194

mattowen_uk wrote: post #184

Shifting from passwords to more secure systems such as MFA ignores the elephant in the room about passwords that no-one wants to acknowledge: People share passwords. A simple example is this: A couple do online grocery shopping every week or so, depending who has time to do it, one them will log into the 'account' and build the basket. Maybe the other will then amend the basket a few hours later before the cut off ti…

I agree sharing passwords is a really common thing, even among corporate / enterprise SaaS. Even with MFA people share dongles / code pads. But the correct pattern is a formal system for delegation and/or disconnecting 'login' with 'account' (i.e. separate charging for a service from the login). This is something that AWS does very well for example.

On the consumer side there's also the various "Family Sharing" systems that are only now in their youth. I think that's a "digital asset rights" fight waiting in the wings that some sort of "family sharing" should probably be guaranteed (by laws, probably), including to answer questions of proper transferal of "ownership" (right now "family sharing" in most cases isn't something that you can gift in a will/estate; most digital asset accounts aren't considered survivable after the death of their original user).

There are so many interesting legal questions about digital assets that we're all afraid to ask, but probably should be solving today (if not yesterday).

Re: Password expiration is dead, long live passwords

#305

Post by diggernet » Mon, Jun 03, 2019, 7:32 PM UTC

mattowen_uk wrote: post #184

Shifting from passwords to more secure systems such as MFA ignores the elephant in the room about passwords that no-one wants to acknowledge: People share passwords. A simple example is this: A couple do online grocery shopping every week or so, depending who has time to do it, one them will log into the 'account' and build the basket. Maybe the other will then amend the basket a few hours later before the cut off ti…

This is such a ridiculously widespread problem...

When I opened a new joint bank account with my wife, the branch manager was helping set us up for online access. I asked about having our individual logins linked to the joint account. He said they couldn't do that, and we had to share the login for the joint account. I pointed out their TOS had just forbidden us to ever do that. He agreed it was stupid, but they had no other option available.

Re: Password expiration is dead, long live passwords

#306

Post by jvagner » Mon, Jun 03, 2019, 10:10 PM UTC

enriquto wrote: post #175

browningstreet wrote: post #91

Recent, frustrating example: My (business) bank uses FISERV software, and their software expires passwords every 90 days. Their software can notify you about a million combinations of account activities and statuses, except this one. It takes 3 values to login to the account (company ID, username, password). When logging in via mobile app, it never tells you that your password has expired, so I end up trying a few ti…

> When I called the bank to find out how to get notifications that a password has expired, they said there was no way. "When you change your password, set a calendar event for 60 days ahead..." they told me This is a very good reason to change bank. That unacceptable answer would certainly induce me to rage quit the service, whatever the inconvenience.

Possibly, but... have you gone in to a bank and asked if you could test drive all web and mobile apps for some period of time to make sure everything was up to snuff?

FISERV is a dominant player in this space. Either this situation is a matter of configuration/settings, or a limitation of their software.

I have no idea that a different bank would have better systems, and it's a Really Big Deal to move business banking.

Re: Password expiration is dead, long live passwords

#307

Post by jvagner » Mon, Jun 03, 2019, 10:11 PM UTC

lysp wrote: post #146

browningstreet wrote: post #91

Recent, frustrating example: My (business) bank uses FISERV software, and their software expires passwords every 90 days. Their software can notify you about a million combinations of account activities and statuses, except this one. It takes 3 values to login to the account (company ID, username, password). When logging in via mobile app, it never tells you that your password has expired, so I end up trying a few ti…

The problem with having a short expiration is that it forces people to simply use their password with a count: password1, password2, ... password23, password24. This means that if you discover someone's current password, you also have their future 10+ passwords as well.

I use a password manager. I have no idea what ANY of my passwords are, as they're very long, very random, etc.

I get your point... but having an expiry that can't generate a notification is really bizarre. And having done enterprise financial software in a previous life (company was actually sold to FISERV, though I never went over), if our customers had been subjected to these conditions, it would have been a massive challenge.

Re: Password expiration is dead, long live passwords

#308

Post by Aeolun » Tue, Jun 04, 2019, 12:11 AM UTC

thameera wrote: post #226

karrotwaltz wrote: post #193

Earlier quoted context omitted.

Not so long ago I had to register to a website allowing a comma (or was it a semicolon?) in a password during registration but refusing to login using said password. Fun times.

I once spent 15 minutes trying to register in a local Domino's website which kept bugging me about lack of a special character - even though I had one in it. Turned out to be that the app truncates the entered password after the first 20 characters and only considers the first part. Thankfully the special character was after the 20th position so I noticed the error and fixed it, but if it wasn't I'd be wondering the…

Presumably it also truncates the password when doing sign-in?

Re: Password expiration is dead, long live passwords

#309

Post by Aeolun » Tue, Jun 04, 2019, 12:20 AM UTC

reaperducer wrote: post #148

Aeolun wrote: post #143

Earlier quoted context omitted.

Also not helped by the fact that passwords have to include every symbol and their mother, cannot include sequential digits, cannot include sequential letters, cannot include any letter of your name, and a bunch of other inane rules that could be changed to simply having a minimum length of 12 instead of 8...

A couple of years ago one of my banks "upgraded" its web site, forcing me to change my password to comply with its revised password guidelines since my old password was no longer permitted. The result was a password that was shorter, less varied, and less secure than the previous one. Good job, Chase.

People were forgetting their passwords and using up valuable support time.

Since the responsibility for password storage is on the customer anyway, we might as well make our password a maximum of 6 characters!

Re: Password expiration is dead, long live passwords

#310

Post by Retric » Tue, Jun 04, 2019, 1:34 AM UTC

setr wrote: post #98

Retric wrote: post #70

Earlier quoted context omitted.

If that’s the fear then all passwords should expire at the same time. Otherwise if you reset every X days, hackers will always have access to some accounts X days.

In the current method, possible access risk is staggered, such that you only have access to some accounts, for some days. In your method, you have access to all or none, for some days. Staggered seems preferable. Note that I’m only arguing your reasoning, not the broader point of password expiration

On day zero staggered means they still have access to ~100% of accounts.

Hackers with access to 100 million accounts generally can use any of them, but not all of them. So, in practice access to 1% or 100% of all accounts may be equally damaging.