Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password expiration is dead, long live passwords

techcrunch.com

Post reply on HN
Print view View original

311–316 of 316 posts

Re: Password expiration is dead, long live passwords

#311

Post by falcor84 »

traydee wrote: post #289
falcor84 wrote: post #286

The article recommends LastPass but ironically LastPass still asks you to change the master passphrase every 180 days. I've complained about this a long time ago and they didn't seem to take my request seriously despite my sending them links to the NIST recommendations.

I've been using lastpass for 6+ years now and its never asked me to change my master passphrase, let alone every 180 days.

Very strange, I wonder if there's anything special about my account. Here's the message I'm getting, when I log into the web console: https://ibb.co/5vMVyJ4

Re: Password expiration is dead, long live passwords

#312

Post by andrewaylett »

tolien wrote: post #273
testvox wrote: post #250

Earlier quoted context omitted.

I thought Yubikeys and other hardware keys were best practice?

They might be a preference but I don’t see how they can be best practice when they’re barely supported on a lot of platforms - Firefox has some support (but doesn’t work with, for example, Github), no/limited support in Safari, no/limited support in mobile devices.

U2F on Firefox works well GitHub in my experience; it's Google that's the problem. Mozilla have added a shim to enable login to Google using a key but (due to spec deviance) if you want to add a key you still need to use Chrome :(.

Re: Password expiration is dead, long live passwords

#313

Post by mrandish »

mattowen_uk wrote: post #184

Shifting from passwords to more secure systems such as MFA ignores the elephant in the room about passwords that no-one wants to acknowledge: People share passwords. A simple example is this: A couple do online grocery shopping every week or so, depending who has time to do it, one them will log into the 'account' and build the basket. Maybe the other will then amend the basket a few hours later before the cut off ti…

Wow, you nailed it. Your post describes our household precisely. The only shared password I have is with my spouse for a grocery list app. The most annoying account problems we have are with accounts for household gear such as wifi-aware garage door opener and pool pump.

Re: Password expiration is dead, long live passwords

#314

Post by mrandish »

snarf21 wrote: post #255
mattowen_uk wrote: post #184

Shifting from passwords to more secure systems such as MFA ignores the elephant in the room about passwords that no-one wants to acknowledge: People share passwords. A simple example is this: A couple do online grocery shopping every week or so, depending who has time to do it, one them will log into the 'account' and build the basket. Maybe the other will then amend the basket a few hours later before the cut off ti…

MFA does not mean no sharing. It is trivial to setup up multiple credentials for the same account. You can easily have two different fingerprints setup as 2FA from two different devices for the same account. Most services let you have backup codes and dongles already. This is mostly an issue of education. We already see a lot of these kinds of other factors like sending a message to device 1 when provisioning device…

> It is trivial to setup up multiple credentials for the same account.

Unfortunately, some very popular 2FA keygen apps can't handle multiple device linked to a single account. I have a well-known service provider that uses a well-known company's app for 2FA. Unfortunately, this app has to be reset to a new device code on changing of the phone's sim card. I wanted to set up two sim cards so I could switch between them for a trip overseas but this is not supported and my service provider does not support other 2FA such as Google or MSFT's app which are not tied to the sim card.

Re: Password expiration is dead, long live passwords

#315

Post by throw0101a »

__HYde wrote: post #298
throw0101a wrote: post #281

Earlier quoted context omitted.

> [...] you might as well use truly random passwords, which have more entropy. At what point is more entropy simply diminishing returns? Five random words gives you 64 bits, and six gives you 77 bits (each word = 12.9 bites): * https://en.wikipedia.org/wiki/Diceware * https://www.rempe.us/diceware/#eff

The primary benefit of Diceware over a "random" string of characters is that it is easy to remember and truly random. With a password manager you don't need to remember the password and it will be generated truly randomly. A string of 11 random alphanumeric charatcers has more entropy than a 5 word diceware passphrase with the added benefit that it is less to type if you need to do so manually. But diceware can be a…

For anyone keeping score at home, some handy-dandy tables with entropy per symbol:

* https://en.wikipedia.org/wiki/Password_strength#Random_passw...

Re: Password expiration is dead, long live passwords

#316

Post by ltc5505 »

SketchySeaBeast wrote: post #280
ltc5505 wrote: post #278

Earlier quoted context omitted.

Customer Rep.: "What is your mother's maiden name?" Scammer: "I just entered a bunch of garbage." Customer Rep.: "Yup! Thanks for verifying that Mr. Smith!"

"A bunch of garbage" is actually kind of a fun answer in itself. "Who was your childhood best friend?" "A bunch of garbage."

Haha that's pretty funny. "Who was your first college roommate?" "A bunch of garbage."
Post reply on HN