Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

There’s no need to change passwords if they're robust, unique and not breached

tidbits.com

Post reply on HN
Print view View original

71–80 of 288 posts

Re: There’s no need to change passwords if they're robust, unique and not breached

#71

Post by ReactiveJelly »

suifbwish wrote: post #26
whoomp12342 wrote: post #16

There is no need for passwords. Cant we figure out something better? its only been like 50 years.

I am very curious why public private key auth is not a thing for websites and applications. I would rather have a single password to the server that publicly hosts my public key then I can simply point websites and applications to that address during signup. Every app/site would check the server every 5-20 mins for changes to my public key in case I need to change it. Then I can use my private key to authenticate to…

Because storage media can be shared and lost.

If you're logging in from a library computer, you don't want the hassle of putting your privkey file on it and wiping it later. (Or connecting a USB drive, which may be a security hazard for the library)

If you lose your computer, you still remember your password, but your only copy of your privkey may be lost. Losing hard drives is common for non-power users, because they don't do regular backups, and they often don't know that you can trivially recover files from, e.g. a laptop with a broken screen that won't boot.

And computerized cell phones are actively trying to convince those non-power users that files don't even exist, to protect their profits.

Re: There’s no need to change passwords if they're robust, unique and not breached

#72

Post by seanw444 »

UltraViolence wrote: post #44

I use Password Safe, an open-source password database. I highly recommend it for people that are more computer savvy. For the digital illiterates OnePass may be more suitable.

KeePassXC is also a great open-source password manager.

Re: There’s no need to change passwords if they're robust, unique and not breached

#73

Post by jasonpeacock »

wintermutestwin wrote: post #48

I imagine a world where governments get together and mandate that all online passwords use the same standard of password requirements and salt/hashing at the backend. Penalty should be 10% of your gross revenue. While they are at it mandate some standards of customer service if your business exceeds $1M in gross revenue (must have a "get human" button and the call hold time shall not exceed 15 minutes). I know that s…

We effectively have this now with PCI-DSS (requirements imposed by credit-card processing companies), and it sucks because of the bureaucracy involved in making any change.

It has take literally over a decade to relax the requirement for password rotation from 3mo to 1yr for employee accounts of companies that process CC payments, despite industry knowledge and formal studies saying that frequent password rotation was detrimental and useless.

Instead of defining the process, state the outcome you want and set penalties on failing to meet the outcome.

E.g. "don't have password leaks, or it will cost $1k per account paid directly to the account holder" (or your percent of gross, split among leaked accounts). Let companies implement those controls however they wish, as long as they are achieving the outcome and penalties are actually being applied.

I agree that failures need to have significant penalties, otherwise companies will decide that the penalty costs less than the prevention (which is true today) and minimize their investment in security.

Re: There’s no need to change passwords if they're robust, unique and not breached

#74

Post by harryvederci »

simonbarker87 wrote: post #62

For people who have to change their password regularly I suggest just adding the month and year in numbers at the end of whatever password they like to use. That way there is a clue in the current month and year as to what their password probably is should they forget

If a hacker found an old password of yours, the month an year would be a pretty easy indictor of what to try next, right?

Re: There’s no need to change passwords if they're robust, unique and not breached

#75

Post by bombcar »

xboxnolifes wrote: post #64
wccrawford wrote: post #19

Earlier quoted context omitted.

Yeah, bump that to 8 and it's more reasonable. And if it's already required to be randomly chosen, why not 10?

It's not 10 because it still needs to be memorized.

That’s the key people are missing. There’s a trade-off (though people can easily memorize phone numbers for example) when the password gets to complicated and you have to write it down.

Re: There’s no need to change passwords if they're robust, unique and not breached

#76

Post by jihadjihad »

xboxnolifes wrote: post #64
wccrawford wrote: post #19

Earlier quoted context omitted.

Yeah, bump that to 8 and it's more reasonable. And if it's already required to be randomly chosen, why not 10?

It's not 10 because it still needs to be memorized.

I know it's hard to imagine, but before we all held supercomputers in our pockets we all used to have dozens of ten-digit numbers memorized. I still remember my grade school friends' phone numbers.

Re: There’s no need to change passwords if they're robust, unique and not breached

#77

Post by tialaramex »

skbdpup wrote: post #43

> Unless there’s a security breach where it’s stored These can go undetected. Imagine 1. Hacker dumps database with your username & password in it 2. Brute-forces the database offline 3. Logs in as you / Sells it to 3rd party that logs in as you A lot of time can pass between these steps. Changing your password is a mitigation against this scenario.

The correct mitigation for these scenarios, which I agree are a problem, is to not use shared secrets. Key rotation/ changing your password is a poor workaround.

If you steal the WebAuthn database from my toy implementation, now, or tomorrow or ten years in the past, it makes no difference because it doesn't have any secrets in it, so, you don't learn anything useful. "Man, if I was this web site, which I'm not, now I could validate that the authentication was successful".

In such schemes the only thing similar to a "secret" is the Private Key, which exists only briefly temporarily inside my Security Key or other authenticator when it is doing its thing.

Re: There’s no need to change passwords if they're robust, unique and not breached

#78

Post by brightball »

Whenever I talk to people about security, I give a simple thought experiment:

Assume the passwords for all of your users are public. Doesn't matter how it happened. How are your users protected?

The moment that people go down this road of thought everything gets a lot better.

1. How do you restore accounts that may have been taken over?

2. How do you detect logins that look like normal behavior vs those that don't?

3. Is a password alone enough to get them in?

If you address those 3 things everything gets A LOT easier for you and your users.

Re: There’s no need to change passwords if they're robust, unique and not breached

#79

Post by seanw444 »

OJFord wrote: post #50
rubyist5eva wrote: post #41

Earlier quoted context omitted.

One-time use magic links sent to a verified email.

I hate that. (At least allow a password instead.)

Yeah it's an obnoxious process. I don't know why people are so against passwords. Use a manager (or at least something like Lesspass), and then you're fine. Passwords aren't scary. They won't bite.

Re: There’s no need to change passwords if they're robust, unique and not breached

#80

Post by thinkharderdev »

suifbwish wrote: post #26
whoomp12342 wrote: post #16

There is no need for passwords. Cant we figure out something better? its only been like 50 years.

I am very curious why public private key auth is not a thing for websites and applications. I would rather have a single password to the server that publicly hosts my public key then I can simply point websites and applications to that address during signup. Every app/site would check the server every 5-20 mins for changes to my public key in case I need to change it. Then I can use my private key to authenticate to…

I really hope that password managers are a step in this direction. Once they become ubiquitous then everyone effectively already has a "master password" for all their online identities. It wouldn't even really need to be a 3rd party service. The password managers could hold the keys locally and websites could just use WebAuthn for authentication.
Post reply on HN