Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

49% of workers, forced to change passwords, reuse same one with minor change

grahamcluley.com

Post reply on HN
Print view View original

71–80 of 316 posts

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#71

Post by Sohcahtoa82 »

nickthegreek wrote: post #55
trianglem wrote: post #52

Earlier quoted context omitted.

I agree with all of this except password managers. If you use a lot of different public computers or temporary work laptops they don’t always let you install LastPass, so I frequently ended up being unable to access my accounts.

I access my manager from my phone and type them in. I would never install my LastPass on a public computer even if they let me.

And then you've got your phone open, displaying your password to shoulder surfers, for as long as it takes to type in your password.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#72

Post by Wowfunhappy »

xamuel wrote: post #62
PeterStuer wrote: post #27

Wonder how many % use the password reset as an effective one-time password (unless cached) as they can't be arsed to remember the password complexity rules for every single site thwarting their simple password variations scheme.

For systems with automated password resets sent to email, what even is the point of a password at all? It literally accomplishes nothing. Just get rid of the password entirely and make checking email officially a part of the login.

I find typing in a password (or letting my password manager fill it in) to be much more convenient than clicking a link in my email.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#73

Post by kerng »

UncleMeat wrote: post #59
kardos wrote: post #54

Earlier quoted context omitted.

yes but if you get keylogged while using a pw manager, you lose everything, as compared to losing one (or a few, depending on how egregious your passowrd reuse is)

If you have malware on your machine you already lose everything.

This is not true. If malware runs on your machine and there is no password manager storing 1400 passwords, the malware cannot pivot to 1400 destinations. However, if there is a password manager on the device that the malware gains access to and it would indeed store 1400 passwords in one place, then all 1400 assets are compromised at once.

I think that's what the previous commenter wanted to highlight.

In the end it's about managing risks, I would use different locations for storing passwords depending on value. Like really important ones go elsewhere and are not on the device I use everyday for browsing the Internet or reading email.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#74

Post by Sohcahtoa82 »

MrMember wrote: post #13

The password requirements at my job are, in my opinion, insane. It has to be a specified length (an exact number of characters, no more, no less), can't contain any 3+ character words found in a dictionary, and a few other requirements like at least one capital letter and at least one number. And it has to change every three months. So yes, when I have to change my password I end up changing a single character or dig…

I've heard of banks setting a 8-character limit on password length.

If my bank did that, I'd be searching for a new bank. Just just reeks of passwords being stored in plain text.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#75

Post by clarry »

Vomzor wrote: post #43

The thing I hate the most is random websites forcing you to use a password with "at least 8 characters, capital letters, numbers, .." I only care about my email account and a couple of other important websites. I want to be able to use the same simple password on other websites. So what if my account on pinterest or my local news website or some random forum is compromised... I don't care. I will either reset my pass…

> The thing I hate the most is random websites forcing you to use a password with "at least 8 characters, capital letters, numbers, .."

You can come up with a simple and easy-to-remember phrase for those. If it expresses your irritation with those rules and annoying mandatory logins, it's easier to remember. For example, FuckOff1234!

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#76

Post by ahelwer »

teekert wrote: post #70

Of course we do. My password manager does not work for the Windows login and I need to change it every 3 months. I can remember 1 large complicate pass-sentence, but not a different one every three months.

The answer here is to use a Windows Hello PIN along with a very complicated password (stored in your password manager) that is almost never used.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#77

Post by Sohcahtoa82 »

Ididntdothis wrote: post #21

I think they should go with fingerprints. I have to change my password every three months so I reuse the same password with a few numbers incremented. For a while I created completely new passwords but constantly memorizing them got really annoying. That’s the problem with a lot of security recommendations. Often they are very inconvenient.

> I think they should go with fingerprints.

Fingerprints are probably the least secure method of authentication possible. Picking up your fingerprint off of something you touched and fooling a fingerprint reader is pretty trivial. And worst, it's not something you can change, so once your fingerprint is copied, it's compromised permanently.

Fingerprints should never be considered a security feature. At most they're a convenience feature.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#78

Post by cptskippy »

teekert wrote: post #70

Of course we do. My password manager does not work for the Windows login and I need to change it every 3 months. I can remember 1 large complicate pass-sentence, but not a different one every three months.

Same. I'm currently on the 15th permutation of the same password. But we implemented 2Fa this year so now I still have to change my password regularly, and pull a code from my phone that's generated on demand (as opposed to temporal rollover) so it needs to be connected, AND I have to enter in my password about 75 times a day because it goes part and parcel with the 2Fa prompts.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#79

Post by cptskippy »

ahelwer wrote: post #76
teekert wrote: post #70

Of course we do. My password manager does not work for the Windows login and I need to change it every 3 months. I can remember 1 large complicate pass-sentence, but not a different one every three months.

The answer here is to use a Windows Hello PIN along with a very complicated password (stored in your password manager) that is almost never used.

Except most organizations won't let you.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#80

Post by thiagomgd »

discreditable wrote: post #47
criddell wrote: post #45

Earlier quoted context omitted.

Are you saying NIST and Schneier are wrong about this?

Schneier says "don't make people change their passwords unless there's indication of compromise" I make the assumption that the longer a password exists, the more likely it's reused and compromised. I don't have insight into every password dump, but I know my users reuse passwords a lot. I think a long expiry is the best balance in my environment.

if a password expires every year, people are just going to use P@ssword2018, P@ssword2019 and so on...

You require new passwords every year, done Require symbols, done lower and uppercase, done numbers, done

Post reply on HN