Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

There’s no need to change passwords if they're robust, unique and not breached

tidbits.com

Post reply on HN
Print view View original

61–70 of 288 posts

Re: There’s no need to change passwords if they're robust, unique and not breached

#61

Post by falcolas »

chimeracoder wrote: post #29
ejb999 wrote: post #20

I am in the camp of requiring people to have strong passwords, and not requiring them to be changed - ever. When you ask people to remember too many passwords, they start writing them down and/or forgetting them, which leads to other problems. My oldest online account - btw it is a brokerage account at one of the big brokerage houses, where a great deal of my cash and investments sit - has not asked me to change the…

> When you ask people to remember too many passwords, they start writing them down and/or forgetting them, which leads to other problems. Writing passwords down isn't the worst thing. If you can't convince someone to use a password manager like 1Password, getting them to use a physical notebook of unique and strong passwords is actually the next best thing, because (combined with 2FA) it protects them against the mos…

A business card stored in a wallet or purse is pretty good too. After all, we're already pretty used to protecting our credit cards, identity cards, and cash.

Re: There’s no need to change passwords if they're robust, unique and not breached

#62

Post by simonbarker87 »

For people who have to change their password regularly I suggest just adding the month and year in numbers at the end of whatever password they like to use. That way there is a clue in the current month and year as to what their password probably is should they forget

Re: There’s no need to change passwords if they're robust, unique and not breached

#63

Post by seanw444 »

Darmody wrote: post #24
colinclerk wrote: post #7

Perhaps surprisingly, US government guidelines exist, are pretty fantastic, and agree with the author: Memorized secrets SHALL be at least 8 characters in length if chosen by the subscriber. Memorized secrets chosen randomly by the CSP or verifier SHALL be at least 6 characters in length and MAY be entirely numeric. If the CSP or verifier disallows a chosen memorized secret based on its appearance on a blacklist of c…

6 characters and entirely numeric seems like a bad idea, or am I missing something?

That provides one million possibilities. I don't think you're missing anything. That's pretty terrible.

The only thing prolonging your account at that point is the service's rate-limiting, assuming a naive "enter this password in the login field, try it, repeat."

Re: There’s no need to change passwords if they're robust, unique and not breached

#64

Post by xboxnolifes »

wccrawford wrote: post #19
6LLvveMx2koXfwn wrote: post #11

Earlier quoted context omitted.

6 characters in length seems a bit shoddy.

Yeah, bump that to 8 and it's more reasonable. And if it's already required to be randomly chosen, why not 10?

It's not 10 because it still needs to be memorized.

Re: There’s no need to change passwords if they're robust, unique and not breached

#65

Post by ReactiveJelly »

adam0c wrote: post #51

#PREACH! the Hive infograpgh (amongst others) always comes to mind; 18 characters long, upper, lower, numerical, special. estimate time to brute force 438tn years.

How many years to memorize and type 18 random characters?

Re: There’s no need to change passwords if they're robust, unique and not breached

#66

Post by falcolas »

iso1631 wrote: post #58
gspencley wrote: post #45

Earlier quoted context omitted.

You're probably right that, in practice, the character class doesn't automatically add security if the password is sufficiently strong and random. The theory is that by introducing special characters you're decreasing the likelihood of having characters that are commonly found together, thus decreasing the effectiveness of dictionary attacks. Of course modern dictionary algorithms will still look for characters that…

Vast majority of passwords will have just 1 symbol, either at the start or end, or replace A with @, S with $, etc P@55w0rd! Is an awful password, yet meets many security policies P@ssword2, P@ssword3, P@ssword4 etc Also meet them, and rotate just fine. Meanwhile dadbffc67f798e8e0b7441fb995aeabe Is perfectly fine, but often is not allowed

> Is perfectly fine, but often is not allowed

Nor is "correct horse battery staple". For wanting symbols, so many password systems really hate spaces.

Re: There’s no need to change passwords if they're robust, unique and not breached

#67

Post by watwut »

civilized wrote: post #52
ejb999 wrote: post #20

I am in the camp of requiring people to have strong passwords, and not requiring them to be changed - ever. When you ask people to remember too many passwords, they start writing them down and/or forgetting them, which leads to other problems. My oldest online account - btw it is a brokerage account at one of the big brokerage houses, where a great deal of my cash and investments sit - has not asked me to change the…

Writing passwords down is inevitable. Having to remember more than two truly strong passwords is a ridiculous requirement to impose on the general population, and we live in a world where we need access to dozens of different accounts which ideally are supposed to all have different passwords. We either need password managers or we need to do away with passwords entirely.

I will go further, expecting people to remember single strong password and change it every 3 months and not write it down is too much. Because after literally three rotation people will confuse previous and current password. And they will be out of memoizable ideas.

Re: There’s no need to change passwords if they're robust, unique and not breached

#68

Post by gonzo41 »

ejb999 wrote: post #20

I am in the camp of requiring people to have strong passwords, and not requiring them to be changed - ever. When you ask people to remember too many passwords, they start writing them down and/or forgetting them, which leads to other problems. My oldest online account - btw it is a brokerage account at one of the big brokerage houses, where a great deal of my cash and investments sit - has not asked me to change the…

Your money is insured, your brokers are insured. They just manage the risk differently than people directly in the tech world. Even though banks are right in the middle of it.

A good analogy for banks risk mitigation is like putting up a guard rail in front of a cliff. It's up to the user how high the rail gets set. Like daily limits, notifications, initial passwords, 2fa etc.

For the most part, banks and brokers want to reduce the friction of events.

Re: There’s no need to change passwords if they're robust, unique and not breached

#69

Post by kevindong »

Darmody wrote: post #24
colinclerk wrote: post #7

Perhaps surprisingly, US government guidelines exist, are pretty fantastic, and agree with the author: Memorized secrets SHALL be at least 8 characters in length if chosen by the subscriber. Memorized secrets chosen randomly by the CSP or verifier SHALL be at least 6 characters in length and MAY be entirely numeric. If the CSP or verifier disallows a chosen memorized secret based on its appearance on a blacklist of c…

6 characters and entirely numeric seems like a bad idea, or am I missing something?

To continue that quote from above:

> A rationale for this is presented in Appendix A Strength of Memorized Secrets.

The relevant part of which reads:

> The minimum password length that should be required depends to a large extent on the threat model being addressed. Online attacks where the attacker attempts to log in by guessing the password can be mitigated by limiting the rate of login attempts permitted...

>

> Offline attacks are sometimes possible when one or more hashed passwords is obtained by the attacker through a database breach. The ability of the attacker to determine one or more users’ passwords depends on the way in which the password is stored. Commonly, passwords are salted with a random value and hashed, preferably using a computationally expensive algorithm. Even with such measures, the current ability of attackers to compute many billions of hashes per second with no rate limiting requires passwords intended to resist such attacks to be orders of magnitude more complex than those that are expected to resist only online attacks.

Re: There’s no need to change passwords if they're robust, unique and not breached

#70

Post by rterrin »

e1g wrote: post #28

In the USA, the latest government guidance from Jan 2022 is that "Password policies MUST NOT require use of special characters or regular rotation". [1] This is a strong upgrade from earlier softer language like "don't have to/should not". In practice, this new rule contradicts almost every InfoSec stance out there, but all government agencies must comply with this new rule by the end of the year, so expect lots of c…

I worked on Identity, Credentialing and Access Management (ICAM as it's known) in the Federal space for a while.

The U.S. Fed Gov has been implementing MFA with smart cards since 2001. While there are pockets of ineptitude and resistance, the vast majority of government employees and contractors use a hard token second factor.

Security is a property of a system, so analyzing a particular password policy outside of the given context (mandatory hard token MFA) is nonsense.

Post reply on HN