Frequent Password Changes Is a Bad Security Idea • Hacker News Board

Re: Frequent Password Changes Is a Bad Security Idea

#41

Post by QuarterReptile » Sun, Aug 07, 2016, 2:46 PM UTC

adrianN wrote: post #13

joeskyyy wrote: post #7

I usually just make up a crazy long sentence I'll remember, with no logical order in it. Something funny to me so I'll easily remember it. Throw in some assortment of numbers and symbols. Bam! Works like a charm!

Then the sysadmin hits you with a "at least 8 characters, no more than 13, one uppercase, one lowercase, a number, a special character, but not one that can't be encoded in EBCDIC and the password must differ in at least three places from the last 10 you used."

No more than three consecutive letters. That's when things get tedious.

Re: Frequent Password Changes Is a Bad Security Idea

#42

Post by snuxoll » Sun, Aug 07, 2016, 3:25 PM UTC

QuarterReptile wrote: post #41

adrianN wrote: post #13

Earlier quoted context omitted.

Then the sysadmin hits you with a "at least 8 characters, no more than 13, one uppercase, one lowercase, a number, a special character, but not one that can't be encoded in EBCDIC and the password must differ in at least three places from the last 10 you used."

No more than three consecutive letters. That's when things get tedious.

Entropy? What's that.

Re: Frequent Password Changes Is a Bad Security Idea

#43

Post by kwhitefoot » Sun, Aug 07, 2016, 3:44 PM UTC

ukj wrote: post #35

To prevent people doing this just throw in a string similarity algorithm into your password-change UI. if similarity(old_password,new_password) > 50% then reject password change...

How does that work? Or, rather, if that can work the system has even bigger problems because you must be storing the passwords in plain text instead of salted hashes.

Re: Frequent Password Changes Is a Bad Security Idea

#44

Post by timmytokyo » Sun, Aug 07, 2016, 3:59 PM UTC

jwatte wrote: post #4

Tell that to Wells Fargo commercial. 12 character max, change every other month.

If they nave a maximum pw length, they probably have a significant aecurity issue. Namely, they are likely not storing a hash.

Re: Frequent Password Changes Is a Bad Security Idea

#45

Post by paulddraper » Sun, Aug 07, 2016, 4:26 PM UTC

The point of changing your password is to counteract any hacked passwords, I think.

But WHY ARE YOUR PASSWORDS BEING COMPROMISED?

That's what you need to address.

Re: Frequent Password Changes Is a Bad Security Idea

#46

Post by jjnoakes » Sun, Aug 07, 2016, 4:43 PM UTC

koolba wrote: post #38

I've never met anyone in the corporate world that does not suffix a digit to their password that increments with each mandatory password change. Most people start with "foobar"[1] then become "foobar2", "foobar3", etc. [1]: Or maybe "Foobar" (because you need a capital letter) or "Foobar!" (because you need a capital letter and a non-alphanumeric letter).

I've never met anyone in the corporate world who can do that; all of the important systems I've seen require the new password to be "different enough" from the old. Appending or changing a couple of digits isn't accepted.

Re: Frequent Password Changes Is a Bad Security Idea

#47

Post by wglb » Sun, Aug 07, 2016, 5:35 PM UTC

MAGZine wrote: post #6

For those who work at corporations with password rotation policies, it may actually be a good way to get creative. This guy changed password rotations into a lifehack: https://medium.com/the-lighthouse/how-a-password-changed-my-... Previous discussion on it: https://news.ycombinator.com/item?id=8015470

We used this story in our security awareness training. Great approach.

Re: Frequent Password Changes Is a Bad Security Idea

#48

Post by Sean1708 » Sun, Aug 07, 2016, 6:27 PM UTC

kwhitefoot wrote: post #43

ukj wrote: post #35

To prevent people doing this just throw in a string similarity algorithm into your password-change UI. if similarity(old_password,new_password) > 50% then reject password change...

How does that work? Or, rather, if that can work the system has even bigger problems because you must be storing the passwords in plain text instead of salted hashes.

It could be done on the client if you get them to enter their old and new passwords.

Re: Frequent Password Changes Is a Bad Security Idea

#49

Post by tzs » Sun, Aug 07, 2016, 6:50 PM UTC

Sean1708 wrote: post #48

kwhitefoot wrote: post #43

Earlier quoted context omitted.

How does that work? Or, rather, if that can work the system has even bigger problems because you must be storing the passwords in plain text instead of salted hashes.

It could be done on the client if you get them to enter their old and new passwords.

If they are going to have a "new not similar to old" policy, it should probably be done on the server rather than the client, because the client is less trustworthy.

A password change dialog needs to be asking for the old password anyway and then verifying that it is correct to protect against people who step away from logged in sessions having their passwords changed by pranksters or worse.

I doubt "new not similar to old" policies actually accomplish much. If they are implemented securely using standard technology they will only be able to check the proposed new password against the current password. That just means that instead of having a sequence of similar passwords, P1, P2, P3, ..., users will have two such sequences interleaved: P1, Q1, P2, Q2, ..., where all the P's are similar and all the Q's are similar but the P's are not similar to the Q's.

There's probably a way to do a similarity check between two passwords given just hashes of the passwords (for instance, using homomorphic encryption), but that kind of thing is more research level than deploy live level, I believe. If/when that becomes practical, then a no similarity policy could go back as far as you are willing to keep old password hashes around without being any less secure than a no reuse policy going back as far.

Re: Frequent Password Changes Is a Bad Security Idea

#50

Post by koolba » Sun, Aug 07, 2016, 7:31 PM UTC

jjnoakes wrote: post #46

koolba wrote: post #38

I've never met anyone in the corporate world that does not suffix a digit to their password that increments with each mandatory password change. Most people start with "foobar"[1] then become "foobar2", "foobar3", etc. [1]: Or maybe "Foobar" (because you need a capital letter) or "Foobar!" (because you need a capital letter and a non-alphanumeric letter).

I've never met anyone in the corporate world who can do that; all of the important systems I've seen require the new password to be "different enough" from the old. Appending or changing a couple of digits isn't accepted.

Every LDAP password policy I've seen only prevents the previous N passwords (usually 5 or 6), requires some combination of upper case, lower case, and numbers, and possibly some punctuation. I've never seen one that actually compares permutations of your prior passwords to check for a minimum change set.