A minor recommendation: remove the word “just” from the following paragraph.
> At Tailscale, we believe in security that’s adaptive, intelligent, and actually useful — not —just- security theater.
Frequent reauth doesn't make you more secure
461–470 of 539 posts
Re: Frequent reauth doesn't make you more secure
#462Earlier quoted context omitted.
I'm confused by this comment. Can you clarify exactly which poor design flow you're talking about?
1. Input username/password -> get email otp code. 2. Forget password -> get email for new password -> input username/new password -> get email otp code. The only actual security factor here is your [email, email password], everything else is just silly rigamarole.
[deleted]
Re: Frequent reauth doesn't make you more secure
#463Earlier quoted context omitted.
For most people, writing (most of) their password on a piece of paper that they keep in their wallet would be pretty good security. Paper can't be hacked, and writing down the password allows for more complicated passwords. In case someone gets access to your wallet, you still keep a portion of the password not written down. (And if someone gets physical access to your stuff, you are hosed in general, because they ca…
It really depends on what password. At home our wifi password is on a paper, right there on the office board. If you landed in the room, I won't feel more in security if you need other actions to get the password out of me.
> At home our wifi password is on a paper, right there on the office board.
You probably should know that recent smartphones (the most likely devices to ask for a wifi password at home) have features to share a password right in the settings. iPhones will simply ask you (or anyone connected) to allow them, and androids have some sort of sharing enabled (via qr code generally).
Re: Frequent reauth doesn't make you more secure
#464Earlier quoted context omitted.
> If the password length is 12 to 15 characters, it will be valid for 180 days > If the password length is 16 to 32 characters, it will be valid for 365 days Madness.
I'm a big fan of "should not include profanity, words of a vulgar nature". It's not unthinkable my password manager comes up with a chain of letters that at one point will include "fuck".
> I'm a big fan of "should not include profanity, words of a vulgar nature".
On my first Wireguard testbed, WG's keygen dropped one at the front of the key. It remains my most treasured digital possession.
Re: Frequent reauth doesn't make you more secure
#465Earlier quoted context omitted.
No modern IT organization mandates periodical password changes since, I dunno, mid-2000's. edit : please note the "modern" qualifier, tons of IT orgs continue to mandate this anachronistic policy, sure, but those orgs aren't modern, the policy isn't a requirement for e.g. SOC2 or whatever, it's purely historical inertia.
> the policy isn't a requirement for e.g. SOC2 or whatever It is a PCI requirement and probably from other sources. Of course it is brain dead and we even have authoritative documentation from NIST explaining why it is stupid, but nobody at PCI has any technical skills to understand that so the madness lives on.
>It is a PCI requirement
The only requirement for password rotation in PCI DSS v4.0 is if the password is the only form of authentication (i.e. no MFA). Use MFA (which you should be anyways) and you don't need to enforce password rotation.
>Clarified that this requirement applies if passwords/passphrases are used as the only authentication factor for user access (i.e., in any single-factor authentication implementation).
>Added the option to determine access to resources automatically by dynamically analyzing the security posture of accounts, instead of changing passwords/passphrases at least once every 90 days.
Re: Frequent reauth doesn't make you more secure
#466Earlier quoted context omitted.
Even worse. NIS2 in the European Union makes password changes legally required for many organisations. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=PI_... 11.6.2 (c)
I’ve been told PCI does as well, though I don’t know if that’s really still true. Edit: jjav beat me to it below, confirming it is.
PCI DSS 4.0 does not require password rotation unless the password is the only authentication (i.e. no MFA).
Use MFA, and you don't need to rotate.
>Clarified that this requirement applies if passwords/passphrases are used as the only authentication factor for user access (i.e., in any single-factor authentication implementation).
>Added the option to determine access to resources automatically by dynamically analyzing the security posture of accounts, instead of changing passwords/passphrases at least once every 90 days.
Re: Frequent reauth doesn't make you more secure
#467Earlier quoted context omitted.
There are policies to prevent changing the password more than once a day to prevent that. I've encountered it in several places
There are also systems that keep a history of old passwords just to prevent you from reusing one.
I like the ones that not only keep a history of your old passwords but will reject any password that is similar to any of your 30 previous passwords, which means they're storing either a plaintext or reversibly encrypted list of every password somewhere on the system. Talk about a goldmine for the hacker that dumps that database.
Re: Frequent reauth doesn't make you more secure
#468Earlier quoted context omitted.
1. Input username/password -> get email otp code. 2. Forget password -> get email for new password -> input username/new password -> get email otp code. The only actual security factor here is your [email, email password], everything else is just silly rigamarole.
Note that by doing it that way they don't have to have a special case for handling input of username/password when that password is a new password. Making security critical code simpler is generally a good idea. Whether it is worth annoying some users in the password reset case to avoid making the login code slightly more complicated is going to depend on your specific situation.
I read their point as why have passwords at all when the security is you having access to your email account.
Re: Frequent reauth doesn't make you more secure
#469IMHO there are only 2 requirements for a good password:
1. It must be close to impossible for a computer to guess.
2. It must be easy for a human to remember.
Virtually all password policies focus exclusively on point #1, with the vast majority just giving cargo cult instructions without really understanding the state of the art. Almost nobody puts any emphasis on point #2, which is arguably more important as it is the source of most breaches. If a person can't create a password, ignore it for a week, and then remember it immediately for the next login it's a bad password. This is where requirements like "no more than two characters from a character set (lower case, upper case, numbers, punctuation) in a row" are actively counterproductive. If the password has to be so convoluted that the user is forced to write it down then you've undermined your own security. Worse, it means the help desk will be forced to reset many many passwords which increases the chances of an impersonation attack succeeding.
Re: Frequent reauth doesn't make you more secure
#470Forced password rotation and expiry seems the bigger problem; given that it causes people to get locked out so often, (e.g. if pw expires when on holiday), — often then requiring travelling to IT, or at least a few hours trying to get IT on the phone to reset, or chasing up colleagues who aren't locked out to get in touch with IT. Many (most?) companies still do it, despite it now not being recommended by NIST: > Ver…
Stuff like ISO27001 still demands it. We have to rotate passwords, against modern cybersecurity practice, in order to comply with an information security standard.
Most frameworks, at least most that I am aware of (north america) have removed password rotation requirements entirely, or have exemptions in place if you have MFA, use risk-based access policies, etc.
Often when people say this, they are parroting their assessor. But not every assessor graduated at the top of their class, or cares to stay updated, or believes that they know better, etc.