#PREACH!
the Hive infograpgh (amongst others) always comes to mind; 18 characters long, upper, lower, numerical, special. estimate time to brute force 438tn years.
There’s no need to change passwords if they're robust, unique and not breached
51–60 of 288 posts
Re: There’s no need to change passwords if they're robust, unique and not breached
#52I am in the camp of requiring people to have strong passwords, and not requiring them to be changed - ever. When you ask people to remember too many passwords, they start writing them down and/or forgetting them, which leads to other problems. My oldest online account - btw it is a brokerage account at one of the big brokerage houses, where a great deal of my cash and investments sit - has not asked me to change the…
Writing passwords down is inevitable. Having to remember more than two truly strong passwords is a ridiculous requirement to impose on the general population, and we live in a world where we need access to dozens of different accounts which ideally are supposed to all have different passwords.
We either need password managers or we need to do away with passwords entirely.
Re: There’s no need to change passwords if they're robust, unique and not breached
#53Re: There’s no need to change passwords if they're robust, unique and not breached
#54I suggested my co-workers, at least half-seriously, that upon mandatory password change the old password should be added to an internal website.
That seems like a good way to ensure people don’t use stupid passwords: public embarrassment.
Re: There’s no need to change passwords if they're robust, unique and not breached
#55In the USA, the latest government guidance from Jan 2022 is that "Password policies MUST NOT require use of special characters or regular rotation". [1] This is a strong upgrade from earlier softer language like "don't have to/should not". In practice, this new rule contradicts almost every InfoSec stance out there, but all government agencies must comply with this new rule by the end of the year, so expect lots of c…
The "character class" requirement really doesn't add much security. And the "password rotation" policy can actually result in worse passwords than otherwise. Those measures were effectively just folk medicine from the days when the threat was thought to be someone manually trying to brute-force your password at your terminal.
> can actually result in worse passwords than otherwise
Does actually. I still require some of the password "rotation" schemes folks would use when we were forced to change them monthly (not a typo, sadly):
1qaz2wsx -> 2wsx3edc -> 3edc4rfv...
Pass1word -> Pass2word -> Pass3word...
Re: There’s no need to change passwords if they're robust, unique and not breached
#56Perhaps surprisingly, US government guidelines exist, are pretty fantastic, and agree with the author: Memorized secrets SHALL be at least 8 characters in length if chosen by the subscriber. Memorized secrets chosen randomly by the CSP or verifier SHALL be at least 6 characters in length and MAY be entirely numeric. If the CSP or verifier disallows a chosen memorized secret based on its appearance on a blacklist of c…
[deleted]
Re: There’s no need to change passwords if they're robust, unique and not breached
#57I imagine a world where governments get together and mandate that all online passwords use the same standard of password requirements and salt/hashing at the backend. Penalty should be 10% of your gross revenue. While they are at it mandate some standards of customer service if your business exceeds $1M in gross revenue (must have a "get human" button and the call hold time shall not exceed 15 minutes). I know that s…
And that customer service MUST NOT accept "I just typed some random words" as the answer to a """security""" question.
Re: There’s no need to change passwords if they're robust, unique and not breached
#58Earlier quoted context omitted.
The "character class" requirement really doesn't add much security. And the "password rotation" policy can actually result in worse passwords than otherwise. Those measures were effectively just folk medicine from the days when the threat was thought to be someone manually trying to brute-force your password at your terminal.
You're probably right that, in practice, the character class doesn't automatically add security if the password is sufficiently strong and random. The theory is that by introducing special characters you're decreasing the likelihood of having characters that are commonly found together, thus decreasing the effectiveness of dictionary attacks. Of course modern dictionary algorithms will still look for characters that…
Vast majority of passwords will have just 1 symbol, either at the start or end, or replace A with @, S with $, etc
P@55w0rd!
Is an awful password, yet meets many security policies
P@ssword2, P@ssword3, P@ssword4 etc
Also meet them, and rotate just fine.
Meanwhile
dadbffc67f798e8e0b7441fb995aeabe
Is perfectly fine, but often is not allowed
Re: There’s no need to change passwords if they're robust, unique and not breached
#59I am unconvinced. What about persistent password bruteforcing? Rate limits? OK, bruteforcing is happening within those rate limits. That's how the password rots - it becomes less of a secret as many values are tried. Key material rotation seems to be a sensible practice in general.
> it becomes less of a secret as many values are tried. Not meaningfully. Let's take my Hacker News password and we'll imagine you happen to know (somehow) exactly what the format is, so then you start guessing. And we'll imagine you can make 1 billion login attempts per second, which in fact I'd guess will make dang pretty unhappy 'cos the servers won't like that. And maybe you get to do this on a billion computers,…
Regarding your last point:
"There are 10^11 stars in the galaxy. That used to be a huge number. But it's only a hundred billion. It's less than the national deficit! We used to call them astronomical numbers. Now we should call them economical numbers." - Richard Feynman
Re: There’s no need to change passwords if they're robust, unique and not breached
#60> Unless there’s a security breach where it’s stored These can go undetected. Imagine 1. Hacker dumps database with your username & password in it 2. Brute-forces the database offline 3. Logs in as you / Sells it to 3rd party that logs in as you A lot of time can pass between these steps. Changing your password is a mitigation against this scenario.
Also, bad practices like logging passwords can be unearthed and fixed without any indication in between the times you change your password.