There is no need for passwords. Cant we figure out something better? its only been like 50 years.
Go ahead and suggest an alternative
One-time use magic links sent to a verified email.
There’s no need to change passwords if they're robust, unique and not breached
41–50 of 288 posts
Re: There’s no need to change passwords if they're robust, unique and not breached
#42In the USA, the latest government guidance from Jan 2022 is that "Password policies MUST NOT require use of special characters or regular rotation". [1] This is a strong upgrade from earlier softer language like "don't have to/should not". In practice, this new rule contradicts almost every InfoSec stance out there, but all government agencies must comply with this new rule by the end of the year, so expect lots of c…
The "character class" requirement really doesn't add much security. And the "password rotation" policy can actually result in worse passwords than otherwise. Those measures were effectively just folk medicine from the days when the threat was thought to be someone manually trying to brute-force your password at your terminal.
> The "character class" requirement really doesn't add much security.
If you're generating your passwords randomly (using a password manager) it actually reduces security because it reduces the set of acceptable passwords.
Re: There’s no need to change passwords if they're robust, unique and not breached
#43> Unless there’s a security breach where it’s stored
These can go undetected. Imagine
1. Hacker dumps database with your username & password in it 2. Brute-forces the database offline 3. Logs in as you / Sells it to 3rd party that logs in as you
A lot of time can pass between these steps. Changing your password is a mitigation against this scenario.
Re: There’s no need to change passwords if they're robust, unique and not breached
#44I use Password Safe, an open-source password database.
I highly recommend it for people that are more computer savvy. For the digital illiterates OnePass may be more suitable.
Re: There’s no need to change passwords if they're robust, unique and not breached
#45In the USA, the latest government guidance from Jan 2022 is that "Password policies MUST NOT require use of special characters or regular rotation". [1] This is a strong upgrade from earlier softer language like "don't have to/should not". In practice, this new rule contradicts almost every InfoSec stance out there, but all government agencies must comply with this new rule by the end of the year, so expect lots of c…
The "character class" requirement really doesn't add much security. And the "password rotation" policy can actually result in worse passwords than otherwise. Those measures were effectively just folk medicine from the days when the threat was thought to be someone manually trying to brute-force your password at your terminal.
You're probably right that, in practice, the character class doesn't automatically add security if the password is sufficiently strong and random. The theory is that by introducing special characters you're decreasing the likelihood of having characters that are commonly found together, thus decreasing the effectiveness of dictionary attacks.
Of course modern dictionary algorithms will still look for characters that are commonly used as substitutes for letters ($ = s, # = h, ! = 1 etc.) so really you just want your password to be random, long and unique.
Re: There’s no need to change passwords if they're robust, unique and not breached
#46Perhaps surprisingly, US government guidelines exist, are pretty fantastic, and agree with the author: Memorized secrets SHALL be at least 8 characters in length if chosen by the subscriber. Memorized secrets chosen randomly by the CSP or verifier SHALL be at least 6 characters in length and MAY be entirely numeric. If the CSP or verifier disallows a chosen memorized secret based on its appearance on a blacklist of c…
6 characters and entirely numeric seems like a bad idea, or am I missing something?
[deleted]
Re: There’s no need to change passwords if they're robust, unique and not breached
#47We should advocate for two step authentication everywhere, so a password leak alone cannot give the attacker access.
Re: There’s no need to change passwords if they're robust, unique and not breached
#48I imagine a world where governments get together and mandate that all online passwords use the same standard of password requirements and salt/hashing at the backend. Penalty should be 10% of your gross revenue.
While they are at it mandate some standards of customer service if your business exceeds $1M in gross revenue (must have a "get human" button and the call hold time shall not exceed 15 minutes).
I know that sounds like a fantasy utopia, but I remember a time in the 70s when there was a serious push for consumer advocacy in the US.
Re: There’s no need to change passwords if they're robust, unique and not breached
#49Earlier quoted context omitted.
The "character class" requirement really doesn't add much security. And the "password rotation" policy can actually result in worse passwords than otherwise. Those measures were effectively just folk medicine from the days when the threat was thought to be someone manually trying to brute-force your password at your terminal.
You're probably right that, in practice, the character class doesn't automatically add security if the password is sufficiently strong and random. The theory is that by introducing special characters you're decreasing the likelihood of having characters that are commonly found together, thus decreasing the effectiveness of dictionary attacks. Of course modern dictionary algorithms will still look for characters that…
The NIST guidelines address that in a much more straightforward way: maintain a list of known bad passwords (e.g., HIBP) and prohibit users from using any of those. Character class requirements are pointless.