Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Frequent reauth doesn't make you more secure

tailscale.com

Post reply on HN
Print view View original

401–410 of 539 posts

Re: Frequent reauth doesn't make you more secure

#401

Post by ExoticPearTree »

qualeed wrote: post #76
inglor_cz wrote: post #58

Earlier quoted context omitted.

My Microsoft account is definitely bothersome like this. I never searched for the root cause (tenant policies? some default value somewhere?), but I have to refresh my password every 4 months or so.

It's a setting in the admin.microsoft.com portal (Org settings -> Security & privacy -> Password expiration policy). The setting, funny enough, is literally "Set passwords to never expire (recommended)". They also link to "Learn why passwords that never expire are more secure" in the same place. Anyone who is forcing expiry is specifically going against recommended policies (Microsoft's, NIST's, and any serious secur…

We had to prove we have a password expiration policy for a compliance audit, showed them that MS recommends not to have passwords expire and the NIST guidance and the auditors were supper happy.

Re: Frequent reauth doesn't make you more secure

#402

Post by tzs »

montebicyclelo wrote: post #189

Forced password rotation and expiry seems the bigger problem; given that it causes people to get locked out so often, (e.g. if pw expires when on holiday), — often then requiring travelling to IT, or at least a few hours trying to get IT on the phone to reset, or chasing up colleagues who aren't locked out to get in touch with IT. Many (most?) companies still do it, despite it now not being recommended by NIST: > Ver…

> Forced password rotation and expiry seems the bigger problem; given that it causes people to get locked out so often, (e.g. if pw expires when on holiday), — often then requiring travelling to IT, or at least a few hours trying to get IT on the phone to reset, or chasing up colleagues who aren't locked out to get in touch with IT.

That is extremely annoying.

On the other hand if I was a manager and that happened to someone I managed we'd definitely have a conversation where I would acknowledge that forced password rotation is idiotic, but also point out that our password expiration is 90 days after the most recent change, which is 12 weeks and 6 days, and ask how come they don't have a "deal with stupid password expiration" event on their calendar set to repeat every 11 weeks?

That gives them 13 days warning. Vacations can be longer than 13 days, but I'd expect that when people are scheduling vacations they would check their calendar and make arrangements to deal with any events that occur when they won't be available. In this case dealing with it would mean changing the password before their vacation starts.

I don't expect people to go all in on some fancy "Getting Things Done" or similar system, but surely it is not unreasonable to expect people to use a simple calendar for things like this?

Re: Frequent reauth doesn't make you more secure

#403

Post by ExoticPearTree »

garyfirestorm wrote: post #205

I hate the corporate office 365. How many times on the same corporate laptop on which I log in from home do I need to reenter outlook password and 2FA. I seriously think ms365 login chain is straight broken Click here to sign in - enters userID and pass - thanks for logging out :o

You should be angry at whoever set it like that. In O365 you can sessions last as much as you want.

Currently MS recommends a 90 day window between MFA re-authentication for known devices/browsers you already authenticated on.

Re: Frequent reauth doesn't make you more secure

#404

Post by londons_explore »

tzs wrote: post #402
montebicyclelo wrote: post #189

Forced password rotation and expiry seems the bigger problem; given that it causes people to get locked out so often, (e.g. if pw expires when on holiday), — often then requiring travelling to IT, or at least a few hours trying to get IT on the phone to reset, or chasing up colleagues who aren't locked out to get in touch with IT. Many (most?) companies still do it, despite it now not being recommended by NIST: > Ver…

> Forced password rotation and expiry seems the bigger problem; given that it causes people to get locked out so often, (e.g. if pw expires when on holiday), — often then requiring travelling to IT, or at least a few hours trying to get IT on the phone to reset, or chasing up colleagues who aren't locked out to get in touch with IT. That is extremely annoying. On the other hand if I was a manager and that happened to…

The fact is that you might have an employee who is a real expert in 3rd century archaeology, but scheduling and password changes just aren't what they are here to do. They don't want to do it, don't know how to do it, and don't want to learn how to do it.

Re: Frequent reauth doesn't make you more secure

#405

Post by Sjoerd »

tonymet wrote: post #33

Yahoo published these findings over 20 years ago , that frequent re-auth made customers less secure because it encouraged poor password hygiene like short passwords, writing them down, etc. It's also risky to have the primary password credential transmitted instead of temporary tokens.

Do you have a link to that Yahoo publication? Or any more information on it?

Re: Frequent reauth doesn't make you more secure

#406

Post by ajsnigrutin »

OnShape (web based 3d editing software) is like this. They have a free tier with public-documents-only option, and it's same there.

Open the page... you have to log in, no way to remember you. Sure, you save your password in the browser, but unless you then also click into one of the input fields, the login button is disabled. Then you work on some 3d stuff, export the file, send it to the 3d printer, some time goes by, browser still open, you get the object, and the holes don't line up, you forgot the wall thickness in the measurements, calipers, yep, 3 more milimeters... open onshape tab, nope, you've been logged out. I didn't even close the goddamn window/tab, it's a free account editing a public document.

Re: Frequent reauth doesn't make you more secure

#407

Post by projektfu »

xp84 wrote: post #228
makeitdouble wrote: post #142

Earlier quoted context omitted.

People are _required_ to have complicated passwords in most services. Yet they'll still make you type it out in so many situations, including on account creation confirmation where some service will even block copy/paste to push you to type it. Services will accept losing an user over password grating issues ("no compromise on security"), so it just gets worse and worse.

I get absolutely enraged at sites that block pasting. The two I know of are Quickbooks when paying an invoice with ACH and my tax collector website. I'm pasting in a bank account number and some dumb person somewhere though, "Our users might be pasting in a bank account number... from... a 'bad' copy of it. Let's force them to potentially have to app switch repeatedly, and type 3 numbers at a time, from a 12-digit nu…

I'm very happy with this extension:

https://chromewebstore.google.com/detail/dont-f-with-paste/n...

https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-wi...

https://greasyfork.org/en/scripts/36928-don-t-with-paste (works with Safari)

I get frustrated by having to retype routing/account numbers, or not being able to paste them in the first place. And the ubiquitous e-mail address confirmations. (Given that I still get dozens of e-mails sent to me intended for other people, not spam, just sent to the wrong address, this isn't working. People mistype their e-mail addresses multiple times. You really need to verify the e-mail address by sending an e-mail and asking for a code or a click.)

Re: Frequent reauth doesn't make you more secure

#408

Post by nijave »

zelphirkalt wrote: post #148
nijave wrote: post #77

Earlier quoted context omitted.

>Is it ok that my son stopped at my desk at home and saw customer PII that was left open? In practice/reality, probably. Most employers will disagree. Consider your son could just as easily over hear a phone call, see a piece of paper, etc. If your son was actively malicious, there's all kinds of things from cameras to video splitters to key loggers he could do. If he's not actively malicious, who cares if he sees so…

"Shoulder suffering" a funny one ; )

Whoops missed the autocorrect on that one facepalm

Re: Frequent reauth doesn't make you more secure

#409

Post by tzs »

londons_explore wrote: post #404
tzs wrote: post #402

Earlier quoted context omitted.

> Forced password rotation and expiry seems the bigger problem; given that it causes people to get locked out so often, (e.g. if pw expires when on holiday), — often then requiring travelling to IT, or at least a few hours trying to get IT on the phone to reset, or chasing up colleagues who aren't locked out to get in touch with IT. That is extremely annoying. On the other hand if I was a manager and that happened to…

The fact is that you might have an employee who is a real expert in 3rd century archaeology, but scheduling and password changes just aren't what they are here to do. They don't want to do it, don't know how to do it, and don't want to learn how to do it.

So when they accept an invitation to give a lecture six months from now on the discoveries at the Gudme Hall Complex in Denmark how do they arrange to make sure they will show up?

Re: Frequent reauth doesn't make you more secure

#410

Post by numpad0 »

dcow wrote: post #261
thousand_nights wrote: post #218

Earlier quoted context omitted.

if my password has not been leaked it's insane that providers think i should rotate it, but this still seems to be standard practice for some completely baffling reason

There’s weird math that says your password or generally a secret key is more secure if it’s existed for less time (generated fresh) because there hasn’t been as much time to brute force it. I don’t believe it but some hardcore types do.

it's BSD /etc/passwd being 666 or something, so anyone could brute force it in 180 days, therefore passwords has to have max complexity within 8 bytes limitation and rotated every 180/2 days... who's even started using computers before it was patched?
Post reply on HN