Frequent reauth doesn't make you more secure • Hacker News Board

Re: Frequent reauth doesn't make you more secure

#331

Post by benrutter » Fri, Jun 13, 2025, 4:56 AM UTC

aljgz wrote: post #241

Something related that's barely touched in the post: Bad UX is potential security vulnerability. If your system behaves in unreasonable ways, users are much less likely to notice when it behaves in a slightly different unreasonable way, this time because of a spoofing/phishing, etc. The obvious example: if your system frequently asks for passwords, re-entering passwords becomes a habit (read system one from "thinking…

This is a great take! Similarly, I've seen shadow IT and sneaky work around type stuff crop up a lot before because the "official" way of doing something has picked up too much friction.

Re: Frequent reauth doesn't make you more secure

#332

Post by [deleted] » Fri, Jun 13, 2025, 5:02 AM UTC

repeekad wrote: post #289

SAI_Peregrinus wrote: post #270

Earlier quoted context omitted.

Does anyone not add the year & month of the last password change to the end of their password? E.g. PascalCasePassphraseGoesHere2025-06, then at the next required change in (for example) 6 months: PascalCasePassphraseGoesHere2026-01. It almost certainly fits the inane "letter, number, and special character" requirements they probably have, complies with "different from your last X passwords", and is easy to keep trac…

I’ve personally experienced the password change require that “more than X characters be different than the old password”

[deleted]

Re: Frequent reauth doesn't make you more secure

#333

Post by tiltowait » Fri, Jun 13, 2025, 5:07 AM UTC

lofties wrote: post #330

Mtinie wrote: post #273

Earlier quoted context omitted.

> If the password length is 12 to 15 characters, it will be valid for 180 days > If the password length is 16 to 32 characters, it will be valid for 365 days Madness.

I'm a big fan of "should not include profanity, words of a vulgar nature". It's not unthinkable my password manager comes up with a chain of letters that at one point will include "fuck".

This comment reminded me of a talk I saw[1] about Apple's password generation algorithm. Apparently (and unsurprisingly), they have a list of offensive terms the system is designed to avoid. I expect this is common-enough practice in most popular password managers, but probably not all.

[1] https://www.youtube.com/watch?v=-0dwX2kf6Oc

Re: Frequent reauth doesn't make you more secure

#334

Post by SpaceNoodled » Fri, Jun 13, 2025, 5:08 AM UTC

montebicyclelo wrote: post #189

Forced password rotation and expiry seems the bigger problem; given that it causes people to get locked out so often, (e.g. if pw expires when on holiday), — often then requiring travelling to IT, or at least a few hours trying to get IT on the phone to reset, or chasing up colleagues who aren't locked out to get in touch with IT. Many (most?) companies still do it, despite it now not being recommended by NIST: > Ver…

It honestly forces me to keep a Post-It on my monitor with a hint to this season's new password suffix.

Re: Frequent reauth doesn't make you more secure

#335

Post by tiltowait » Fri, Jun 13, 2025, 5:09 AM UTC

tbrownaw wrote: post #303

lytedev wrote: post #283

Earlier quoted context omitted.

Doesn't enforcing this require storing the password in cleartext somewhere, which is a much more dangerous concept to begin with?

Similarly of new vs current password is simple enough by just requiring the current password as part of the password change call. Which is a good idea anyway so someone can't just walk up and change your password if you forget to lock things over lunch. Similarly vs older passwords is what would be an issue.

> Similarly vs older passwords is what would be an issue.

Which isn't unheard of, though it's been years since I've seen it.

Re: Frequent reauth doesn't make you more secure

#336

Post by bigfatkitten » Fri, Jun 13, 2025, 5:12 AM UTC

majkinetor wrote: post #325

bigfatkitten wrote: post #234

Earlier quoted context omitted.

In the corporate space you should move away from passwords entirely. Smart cards have had pretty solid ecosystem support for the past two decades thanks to the U.S. Government and HSPD-12, and now we’ve got technologies like webauthn that make passwordless authentication even easier.

And require smart card, reader, drivers etc... nah

Or a yubikey, or a webcam, or a fingerprint sensor…

Re: Frequent reauth doesn't make you more secure

#337

Post by yardstick » Fri, Jun 13, 2025, 5:12 AM UTC

bisby wrote: post #327

deathanatos wrote: post #297

Earlier quoted context omitted.

I just let the keyring roll a completely new password. For some reason, all of my employers do require this insanity, but not on the one password I have to actually type.

I once had an employer that required us to use passworded SSH, and disallowed SSH keys, because they couldn't enforce that the SSH keys were passphrase protected, so just turned that option off. They said it was a PCI requirement, or something.

PCI requires multi-factor auth these days, so you’ll likely find now the ssh password will be your password plus a OTP at the end.

Re: Frequent reauth doesn't make you more secure

#338

Post by flashblaze » Fri, Jun 13, 2025, 5:15 AM UTC

Might be tangent, but Cursor has this the worst. Each time you close the browser and open, you're logged out. I have no idea why they do this.

Re: Frequent reauth doesn't make you more secure

#339

Post by yardstick » Fri, Jun 13, 2025, 5:18 AM UTC

lytedev wrote: post #283

sakesun wrote: post #262

Earlier quoted context omitted.

Password similarity rule was not enforced ?

Doesn't enforcing this require storing the password in cleartext somewhere, which is a much more dangerous concept to begin with?

Not if they ask for the current password at the same time.

https://news.ycombinator.com/item?id=44265372

Re: Frequent reauth doesn't make you more secure

#340

Post by tpxl » Fri, Jun 13, 2025, 5:24 AM UTC

notfed wrote: post #194

vizzah wrote: post #178

I just can't stand email OTP. Before we had passwords, now we have passwords + email OTP. And doesn't matter if you forgot password - you will receive password reset to the same email. You already prove email ownership by resetting or using password - why sending another useless "security token" to the same email. Pure nonsense. Whoever designs all of this clearly has little idea of what they are doing :(

I'm confused by this comment. Can you clarify exactly which poor design flow you're talking about?

1. Input username/password -> get email otp code.

2. Forget password -> get email for new password -> input username/new password -> get email otp code.

The only actual security factor here is your [email, email password], everything else is just silly rigamarole.