Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password expiration is dead, long live passwords

techcrunch.com

Post reply on HN
Print view View original

51–60 of 316 posts

Re: Password expiration is dead, long live passwords

#51

Post by Consultant32452 »

thrower123 wrote: post #15
davemp wrote: post #2

I've always wondered how many engineer hours have been lost on the phone with helpdesks sorting out expired passwords.

It's an insane amount. I've worked on writing helpdesk software for almost a decade now, and from time to time we are asked by our customers to run some analysis on their data; password resets are usually from 25% to 50% of the total requests to the system.

I work in the identity management space of a household name financial institution. We have varying levels of outages, but the top priority one is if people are unable to reset passwords through our UI. It's an absolute nightmare.

Re: Password expiration is dead, long live passwords

#52

Post by tzs »

LeoPanthera wrote: post #20
jaabe wrote: post #16

We’re required to have password expiration by law in the public sector of Denmark. So I’m sure we’ll continue to have it for at least some years to come. I must admit I never really understood the function of it. Obviously lifetime access is more damaging than 3 months access, but the truly devastating thing is the unauthorised access itself not the length of it. Also the policy results in really bad practices like p…

I briefly worked at a place that enforced quarterly password changes and I literally used as my password. I am not good at remembering passwords and I don't think I'm that unusual. Writing them down seemed worse than using a poor password that I can at least remember. Probably these days if forced I would use . I don't know how much better that is. But luckily now I work for myself.

How often have you had information stolen off a credit card, passport, driver's license, insurance card, or other item with sensitive information printed on it that you routinely carry around in your wallet?

For most people, the answer is "never".

We are actually quite good at safely keeping secrets on paper in our wallets, and so generally writing down a password and keeping it there is fine, especially if the choice is between doing that with a strong password or using a weak password that you memorize.

Re: Password expiration is dead, long live passwords

#53

Post by EnderWT »

"Periodic password expiration is a defense only against the probability that a password (or hash) will be stolen during its validity interval and will be used by an unauthorized entity. If a password is never stolen, there’s no need to expire it. And if you have evidence that a password has been stolen, you would presumably act immediately rather than wait for expiration to fix the problem."

Full post: https://blogs.technet.microsoft.com/secguide/2019/05/23/secu...

Re: Password expiration is dead, long live passwords

#54

Post by Consultant32452 »

FlorianRappl wrote: post #6
Raistael wrote: post #3

I'm not entirely sure that I'd agree with this mentality. Sure, at a glance it sounds good. If the password has been safeguarded, there's really not much reason to force expiration. However, wouldn't the age of the password reduce the security of it by default? The longer a password exists for, the more likely it is that it can be cracked, discovered by a misplaced Post-It note, or compromised by some other unknown s…

Reality is that a password expiration policy quite often leads to password simplification (e.g., having an incremented number in the password, post its on the screen, ...). I'd prefer 2FA and (allowing / encouraging) longer / stronger passwords over change policies.

At one of my previous employers the default password set by the help desk was [company_name]@123. They did a password audit and a full third of the employees had a variation of this password for their real password. It's not Google, but if it were, passwords were things like: google@321, google@456, etc.

Re: Password expiration is dead, long live passwords

#55

Post by xfitm3 »

jeremyjh wrote: post #17
discreditable wrote: post #12

I still expire passwords on a yearly basis for the sole reason that users have complained to me that it stops them from using the password they use for everything else.

I came here to say this. I can't think of another way to guarantee that they aren't using the same password that they use on every website they've visited since 1997. If anyone has suggestions on this I'd love to hear it.

Strong password policy. Reused passwords are often simple.

Re: Password expiration is dead, long live passwords

#56

Post by technion »

omh wrote: post #26
LeoPanthera wrote: post #23

Earlier quoted context omitted.

What I do: 1. Check the password against the haveibeenpwned.com database. 2. Check the password with the zxcvbn password strength library. If it passes both they can use it. It's not perfect, but it's a lot better than nothing.

How are you implementing these checks? I'm using Active Directory and options for extra password checks are somewhat limited.

Microsoft has a pwnedpasswords-like service you can use:

https://docs.microsoft.com/en-us/azure/active-directory/auth...

Re: Password expiration is dead, long live passwords

#58

Post by noobermin »

scarejunba wrote: post #29
davemp wrote: post #2

I've always wondered how many engineer hours have been lost on the phone with helpdesks sorting out expired passwords.

The real problem? People introduce password expiration to improve security, but the means of producing a new unexpired password after being locked out is less secure than the password itself creating a net loss in security.

How did this idea of expiring passwords arise in the first place? Misguided intuition or did the infosec people back then just get it wrong?

Re: Password expiration is dead, long live passwords

#59

Post by silverwind »

pwg wrote: post #39
dessant wrote: post #24

That's exciting news, though it will take a couple of years until it trickles down to financial institutions. My bank forces me to change passwords every 3 months, and of course they also disable pasting for added security. We also have a local utility that sends you a 5 letter password upon account creation through email, and that's your password. If you try to change it, they'll send you another 5 letter one.

> and of course they also disable pasting for added security. With Firefox, you can set this about:config setting to false to give you back the ability to paste, even when sites try to block it: dom.event.clipboardevents.enabled

Disabling clipboard events will break certain helpful paste mechanisms too, for example pasting images to upload.
Post reply on HN