Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password expiration is dead, long live passwords

techcrunch.com

Post reply on HN
Print view View original

61–70 of 316 posts

Re: Password expiration is dead, long live passwords

#61

Post by hackinthebochs »

Raistael wrote: post #48
afiori wrote: post #34

Earlier quoted context omitted.

> it's often the only way to ensure that the end user actually updates their password regularly It is fair to point out that the relevance of this is dependent on your attack model. If you suspect someone is trying to crack your password then just a longer password is fine. If you suspect a leak then you actually need to change/update password.

This is largely true, but we also exist in a day and age where computing clusters can fire off billions of guesses per second. Anything less than 16 digits takes a questionably small amount of time in comparison, when paired with some of the more advanced attack vectors.

2FA is the solution. That way the password is only to protect against someone who physically has access to your keyfob (nosey coworker, thief, etc). Thinking of passwords as the solution to protect against sophisticated actors is the mistake.

Re: Password expiration is dead, long live passwords

#63

Post by pstch »

rtempaccount1 wrote: post #38
discreditable wrote: post #27

Earlier quoted context omitted.

I'm sure they are, but I think predictability is slightly less bad than being distributed across every single service they've ever used. There's only so much I can do about people not giving a crap.

TOTP or other forms of 2FA are the best way of avoiding the very real problem of user password re-use.

I don't see how TOTP/2FA can avoid the problem of user password re-use. The password has still been reused, whether an extra layer of authentication is used or not.

Maybe you can say that it mitigates it, but I don't think it avoids it at all.

Re: Password expiration is dead, long live passwords

#64

Post by thaumasiotes »

EnderWT wrote: post #53

"Periodic password expiration is a defense only against the probability that a password (or hash) will be stolen during its validity interval and will be used by an unauthorized entity. If a password is never stolen, there’s no need to expire it. And if you have evidence that a password has been stolen, you would presumably act immediately rather than wait for expiration to fix the problem." Full post: https://blogs.…

> If a password is never stolen, there’s no need to expire it. And if you have evidence that a password has been stolen

We've been seeing the point "your personal information is already out there, in the hands of hackers" recently. This cleft seems oddly blind to the possibility that a password has been stolen, but you have no evidence of the fact.

Re: Password expiration is dead, long live passwords

#65

Post by noobermin »

kissgyorgy wrote: post #37

This has known for years now, but unfortunately, takes a long time to change. The other thing what I just read recently and mentioned in this article is about storing secrets in environment variables. That's not good either because every running code and subprocess can read it...

As an ignorant person who doesn't do multiuser anything, how is this a problem if you are sure you're the only user of a physical system? The moment my computer is compromised by anyone else I'd think all bets are off then.

Re: Password expiration is dead, long live passwords

#66

Post by extra88 »

CrowFly wrote: post #35
dessant wrote: post #24

That's exciting news, though it will take a couple of years until it trickles down to financial institutions. My bank forces me to change passwords every 3 months, and of course they also disable pasting for added security. We also have a local utility that sends you a 5 letter password upon account creation through email, and that's your password. If you try to change it, they'll send you another 5 letter one.

I have 2 and 3 year CDs in a bunch of banks. (This is a common use case, people open separate accounts because of the FDIC insurance limit in any one bank). I only need to log in again 2 or 3 years after opening the account to either take the money out, or open another CD. Some of these banks expire passwords every 6 months! That's insane. I have calendar reminders set to remind me to log in and generate another pass…

*A common use-case for millionaires. FDIC limits are $250,000 per-institution, per-account owner, per-account type (CD, money market, savings, checking) and my understanding is joint accounts are considered separate owners so two spouses could have up to $750,000 in CDs at a single bank and be fully insured.

Re: Password expiration is dead, long live passwords

#67

Post by redthrow »

rtempaccount1 wrote: post #42
gowld wrote: post #31

Earlier quoted context omitted.

Writing passwords on paper is recommended by security professionals, in the common case where your physical security is far more trustworthy than your digit security, because it supports the use of long, strong password. A 2FA device is very similar to a Post-It note.

Actually most security professionals have a serious downer on writing passwords down. I can see some circumstances where it could make sense, as you say where physical security concerns are less of an issue. That said I wouldn't say a 2FA device is like a post-it note really. Assuming you're thinking about TOTP like google authenticator, access to the codes is protected by the devices' security, which adds a bit more…

For example Bruce Schneier recommends writing down the password and keeping it in a relatively safe place like the wallet (where people keep other sensitive information like credit card numbers).

https://www.schneier.com/blog/archives/2005/06/write_down_yo...

I don't think anyone recommends writing down the password on a post-it note and put it on the computer screen at work.

Re: Password expiration is dead, long live passwords

#68

Post by SilasX »

Consultant32452 wrote: post #49
CrowFly wrote: post #35

Earlier quoted context omitted.

I have 2 and 3 year CDs in a bunch of banks. (This is a common use case, people open separate accounts because of the FDIC insurance limit in any one bank). I only need to log in again 2 or 3 years after opening the account to either take the money out, or open another CD. Some of these banks expire passwords every 6 months! That's insane. I have calendar reminders set to remind me to log in and generate another pass…

I can't recommend e-banking enough. Through Fidelity you can purchase CDs from a number of banks across the country, shopping for the best interest rates. And you can create an auto-rolling CD ladder if that's your thing. I presume other e-banks like Schwab have similar features. Then you can manage all these things in one place, while getting the benefit of having your funds FDIC insured because they're technically…

I would think money market mutual funds are a more liquid, easier, higher yielding version of that. They don’t have the FDIC insurance, but they’re well diversified and invest in the highest grade of bonds, and “breaking the buck” (holding less than enough to redeem all deposits) is extremely rare.

Re: Password expiration is dead, long live passwords

#69

Post by arendtio »

Nice. So how many years will it take until someone realizes that asking users to include specific character classes actually decreases password security too?

What I mean is that if you ask your users for a password that includes lower-case letters, upper-case letters, numbers and special characters you will probably end up with something like 'Password123!'.

Instead, we could ask our users for reasonably complex passwords without requiring to include specific characters sets. Yes, I am talking about

https://www.xkcd.com/936/

Re: Password expiration is dead, long live passwords

#70

Post by Retric »

thaumasiotes wrote: post #64
EnderWT wrote: post #53

"Periodic password expiration is a defense only against the probability that a password (or hash) will be stolen during its validity interval and will be used by an unauthorized entity. If a password is never stolen, there’s no need to expire it. And if you have evidence that a password has been stolen, you would presumably act immediately rather than wait for expiration to fix the problem." Full post: https://blogs.…

> If a password is never stolen, there’s no need to expire it. And if you have evidence that a password has been stolen We've been seeing the point "your personal information is already out there, in the hands of hackers" recently. This cleft seems oddly blind to the possibility that a password has been stolen, but you have no evidence of the fact.

If that’s the fear then all passwords should expire at the same time. Otherwise if you reset every X days, hackers will always have access to some accounts X days.
Post reply on HN