Earlier quoted context omitted.
Um, that's a really bad sign...
To elaborate for the uninitiated, that means they are storing it in plaintext somewhere.
Unless they ask you for your current password as part of the password change flow.
Frequent reauth doesn't make you more secure
351–360 of 539 posts
Re: Frequent reauth doesn't make you more secure
#352Humans shouldn't generate passwords. ~0 people are good at that. Websites should just generate a password for a user, letting them regenerate as many times as they like until they get one they like (without breaking password manager based generation). A bit like this: https://peergos-demo.net/?signup=true
~0 people want to remember passwords. generating passwords for them without offering to securely store them in a password manager strikes me as misguided.
Re: Frequent reauth doesn't make you more secure
#353I disagree with the general advise behind this, even when I'm in a household with trusted (most of the time) family members. Forcing a re-auth ensures that even if I forget to lock my machine/browser, someone can't snoop around. I want this to be the norm especially for my Macbook since for whatever reason, I might forget to lock or have some program running that'll force the laptop to not auto lock out (e.g. while d…
> Log out as soon as I close the tab For a banking app, I think this is fine. A lot of people aren't aware closing a window isn't logging out. The rest of that is dumb, though.
Nah, that is dumb too. I get what you’re saying though. They could even ask and confirm if that’s the case while logging in and let me have a persistent session on my own machines.
Re: Frequent reauth doesn't make you more secure
#354The previous company I worked for did this kind of frequent expiration, made for a good 2-3 days off every 3 months because I sure as hell wasn't going to set an alarm on the date.
Re: Frequent reauth doesn't make you more secure
#355Earlier quoted context omitted.
"Your password is too similar to your previous password" Hmm, how would you know that.
Don't you generally have to enter the current password to change it to a new one?
Interesting. I guess you could do it on the frontend by asking for old and new passwords simultaneously and sending the hashes to the backend.
That said, it means that you can skip this check by hacking around the front end check haha
Re: Frequent reauth doesn't make you more secure
#356Forced password rotation and expiry seems the bigger problem; given that it causes people to get locked out so often, (e.g. if pw expires when on holiday), — often then requiring travelling to IT, or at least a few hours trying to get IT on the phone to reset, or chasing up colleagues who aren't locked out to get in touch with IT. Many (most?) companies still do it, despite it now not being recommended by NIST: > Ver…
Most SOC2 vendors still require rotation, it is unbelieveably frustrating.
Re: Frequent reauth doesn't make you more secure
#357Forced password rotation and expiry seems the bigger problem; given that it causes people to get locked out so often, (e.g. if pw expires when on holiday), — often then requiring travelling to IT, or at least a few hours trying to get IT on the phone to reset, or chasing up colleagues who aren't locked out to get in touch with IT. Many (most?) companies still do it, despite it now not being recommended by NIST: > Ver…
Stuff like ISO27001 still demands it. We have to rotate passwords, against modern cybersecurity practice, in order to comply with an information security standard.
Re: Frequent reauth doesn't make you more secure
#358Earlier quoted context omitted.
if it causes 90% of people to just enter a simpler password, out of frustration and “fatigue”, then this is irrelevant IMO. Theory doesn’t take into account human behavior. It’s especially annoying when a company enforces these brain dead policies on employees. You want people to waste mental effort changing their passwords by 1 letter every 3 months, just to appease some IT manager? Give me a break lol. I’d rather h…
For most people, writing (most of) their password on a piece of paper that they keep in their wallet would be pretty good security. Paper can't be hacked, and writing down the password allows for more complicated passwords. In case someone gets access to your wallet, you still keep a portion of the password not written down. (And if someone gets physical access to your stuff, you are hosed in general, because they ca…
It really depends on what password. At home our wifi password is on a paper, right there on the office board. If you landed in the room, I won't feel more in security if you need other actions to get the password out of me.
Re: Frequent reauth doesn't make you more secure
#359The people who need to read these articles are the auditors. Until they change their expectations, the many businesses who have to pass audits are still going to be stuck doing a lot of things that are industry-standard but also very stupid. This is the case even for small businesses in certain fields where security audits are valued. We have at least half a dozen measures in place that we know aren't actually helpfu…
I've been pushing NIST on SOC2 auditors for years. They always accept it once given a link.
Yes, it's this rolling on your back and preemptively trying to cover all eventualities that does stuff like this.
It seems like none wants to actually justify their decisions to auditors as its more time critical when the audit happens.
Re: Frequent reauth doesn't make you more secure
#360Humans shouldn't generate passwords. ~0 people are good at that. Websites should just generate a password for a user, letting them regenerate as many times as they like until they get one they like (without breaking password manager based generation). A bit like this: https://peergos-demo.net/?signup=true
~0 people want to remember passwords. generating passwords for them without offering to securely store them in a password manager strikes me as misguided.
People should absolutely be using password managers where possible.
A website doesn't have control over whether you are using a password manager though. This is about stopping the human from generating a password themselves, which will be terrible.