Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Frequent reauth doesn't make you more secure

tailscale.com

Post reply on HN
Print view View original

491–500 of 539 posts

Re: Frequent reauth doesn't make you more secure

#491

Post by yardstick »

mazone wrote: post #398
yardstick wrote: post #337

Earlier quoted context omitted.

PCI requires multi-factor auth these days, so you’ll likely find now the ssh password will be your password plus a OTP at the end.

PCI DSS from 4.0 actually have something called customized approach for everything. If you can prove and the QSA agrees that you fullfill the goal of a requirement, you can be quite flexible. Example i am doing things like not using passwords at all and only passkeys, or only ssh keys protected by hardware security key etc. Together with agents trying to verify the devices connected are company owned and hardened in…

Presumably at some point in your environment you are doing MFA? Just not at every step?

Ie If someone broke into your office, opened computer, inserted the hardware security key, would they get in? Or is there something else non-physical going on? Like the initial login is password + security key, and you can demonstrate the ssh keys never leave the secured PCs etc.

Re: Frequent reauth doesn't make you more secure

#492

Post by SAI_Peregrinus »

deathanatos wrote: post #297
SAI_Peregrinus wrote: post #270

Earlier quoted context omitted.

Does anyone not add the year & month of the last password change to the end of their password? E.g. PascalCasePassphraseGoesHere2025-06, then at the next required change in (for example) 6 months: PascalCasePassphraseGoesHere2026-01. It almost certainly fits the inane "letter, number, and special character" requirements they probably have, complies with "different from your last X passwords", and is easy to keep trac…

I just let the keyring roll a completely new password. For some reason, all of my employers do require this insanity, but not on the one password I have to actually type.

Whenever I don't have to type it, that's what I do. It's the login (or password manager password) needing this counterproductive crap that gets the "append a date" treatment. It's a 10-word diceware passphrase, only used for that login anyway, it's not getting breached if it's stored in even a remotely secure manner (even an unsalted hash would be safe).

Re: Frequent reauth doesn't make you more secure

#493

Post by closeparen »

princevegeta89 wrote: post #36

I hate Apple products for this. I see this pattern across all apple products - not one. On my mac, I setup my touch ID, and log in to my Apple account on the App Store. Time and again, when I try to install apps, it keeps repeatedly prompting for my password, instead of letting me just use my touchID. This applies to free apps as well, which is again silly beyond what is already enough silliness. I briefly see this o…

The extreme security of iCloud accounts is good, given that iMessage, photos, etc. are all in there. The need to re-authenticate your iCloud account to purchase $0.99 app is eyebrow-raising but understandable. But the need to 2FA to download a free app is insane.

Re: Frequent reauth doesn't make you more secure

#494

Post by inquirerGeneral »

montebicyclelo wrote: post #189

Forced password rotation and expiry seems the bigger problem; given that it causes people to get locked out so often, (e.g. if pw expires when on holiday), — often then requiring travelling to IT, or at least a few hours trying to get IT on the phone to reset, or chasing up colleagues who aren't locked out to get in touch with IT. Many (most?) companies still do it, despite it now not being recommended by NIST: > Ver…

[dead]

Re: Frequent reauth doesn't make you more secure

#495

Post by simoncion »

projektfu wrote: post #412
WarOnPrivacy wrote: post #216

From the article: Now that most OSes can unlock with just a fingerprint or face, there's no reason to leave your screen unlocked when you walk away. This statement seems to be unaware that workstations are a thing. In 30 years of onsite support, I think I've seen one desktop PC with a fingerprint scanner. Cameras aren't ubiquitous either. Across the 5 locations I currently service, less than 2 percent of desktop PCs…

If an organization wants fingerprint scanners, they just have to provide them. It's about $15-50 per workstation, if desired. The main problem is they use up an increasingly scarce USB port. Some scanners also rely more on security by obscurity rather than protecting the channel. https://www.google.com/search?q=windows%20hello%20fingerprin... It would be worth doing research to find the best fingerprint scanner that…

> The main problem is they use up an increasingly scarce USB port.

This logic I do not understand. USB hubs exist and are more-or-less commodity parts these days. [0]

I'd be surprised if the fingerprint reader was anything faster than USB 2.0, and deeply offended if the reader did anything other than idle on the bus when it's not being used... so you're not going to be suffering any real bandwidth contention by putting that guy and a USB 3.x device on the same hub.

[0] They're also usually how motherboards that have a whole bunch of USB ports hook those ports into the onboard USB controller(s). (Do folks usually think that every one of the 10gbit/s ports on one's desktop machine could be simultaneously run at 10gbit/s?)

Re: Frequent reauth doesn't make you more secure

#496

Post by zaptheimpaler »

bunderbunder wrote: post #457
ajmurmann wrote: post #449

Earlier quoted context omitted.

It's not money but inertia of very large systems. All these password changes cost money as well. If anything it's a market failure that insurance companies seem to have too little incentive to update their security requirements. This would likely be solved by reducing friction with both evaluating insurers in detail and switching between them.

It's also a sort of moral hazard problem. If you, the person in charge of these decisions, allow an incumbent policy - even a bad one - to stand, then if something goes wrong you can blame the policy. If you change the policy, though, then you're at risk of being held personally responsible if something goes wrong. Even if the change isn't related to the problem. It's not just cybersecurity. I have a family member wh…

I love the analogy to the trolley problem. It sounds like this logic would literally hold up in a real-life trolley problem in regards to the law.

Re: Frequent reauth doesn't make you more secure

#497

Post by focusgroup0 »

ToucanLoucan wrote: post #427
chillfox wrote: post #421

Earlier quoted context omitted.

The requirements usually don’t come from IT. It’s usually on the checklist for some audit that the organisation wants because it lowers insurance premiums or credit card processing fees. In some cases it’s because an executive believes it will be good evidence for them having done everything right in case of a breach. Point being the people implementing it usually know it’s a bad idea and so do the people asking for…

Just an unbreakable law of the universe. "Why did this stupid shit happen? Oh, it's money again."

Not money; incentives

Re: Frequent reauth doesn't make you more secure

#499

Post by eqvinox »

jandrese wrote: post #480
Rexxar wrote: post #478

Earlier quoted context omitted.

Something like that could probably be implemented by storing multiple hash of some automatically modified version of the password. For example, if your password is "PassWorD" they can additionally store the hash of the lowercase version of the password. So if you change it from "PassWorD" to "paSswOrd", they will see it has the same lowercase hash than the previous one without knowing it.

This doesn't seem practical at all. The combinatoral explosion would make the storage requirements impractical for everything but the absolutely most trivial cases like incrementing a number as the very last digit. Even in your simple example you're talking about storing 256 different hashes just to catch one possible mutation on a way too short password.

Technical/pedantic answer: you can store a 'normalized' hashed form of the password, e.g. before hashing it, convert it to all lowercase, replace all digits with 0, sort the characters, … and then do the same to the new password before hashing it, so a whole bunch of stuff will compare "equal".

Practical/actual answer: this is stupid either way.

Re: Frequent reauth doesn't make you more secure

#500

Post by [deleted] »

pests wrote: post #486
arccy wrote: post #384

Earlier quoted context omitted.

I've found that it's only american elevator door close buttons that don't work. The rest of the world manages to keep them operational.

On US elevators there is a minimum open duration to accommodate the handicapped or disabled. The door close button can’t force the door closed any faster. Then most set the auto-close duration equal to this minimum open duration and you get this appearance of buttons doing nothing.

[deleted]
Post reply on HN