Password expiration is dead, long live passwords • Hacker News Board

Re: Password expiration is dead, long live passwords

#81

Post by donatzsky » Sun, Jun 02, 2019, 11:15 PM UTC

pwg wrote: post #39

dessant wrote: post #24

That's exciting news, though it will take a couple of years until it trickles down to financial institutions. My bank forces me to change passwords every 3 months, and of course they also disable pasting for added security. We also have a local utility that sends you a 5 letter password upon account creation through email, and that's your password. If you try to change it, they'll send you another 5 letter one.

> and of course they also disable pasting for added security. With Firefox, you can set this about:config setting to false to give you back the ability to paste, even when sites try to block it: dom.event.clipboardevents.enabled

There's an extension called Don't Fuck With Paste, which is a better solution.

Re: Password expiration is dead, long live passwords

#82

Post by pedrocx486 » Sun, Jun 02, 2019, 11:16 PM UTC

Wowfunhappy wrote: post #57

discreditable wrote: post #12

I still expire passwords on a yearly basis for the sole reason that users have complained to me that it stops them from using the password they use for everything else.

Require all employees to use a password manager?

And spend time training them on using it? I really wish it was a thing but people looked at me like I was an alien when I mentioned it... (I work for a Microsoft subsidiary. I also hope they adopt the new rules, I hate changing passwords every 90 days.)

Re: Password expiration is dead, long live passwords

#83

Post by vbezhenar » Sun, Jun 02, 2019, 11:26 PM UTC

I am not convinced and I'll continue to rotate my passwords on a periodical basis.

Re: Password expiration is dead, long live passwords

#84

Post by tomglynch » Sun, Jun 02, 2019, 11:29 PM UTC

LeoPanthera wrote: post #23

jeremyjh wrote: post #17

Earlier quoted context omitted.

I came here to say this. I can't think of another way to guarantee that they aren't using the same password that they use on every website they've visited since 1997. If anyone has suggestions on this I'd love to hear it.

What I do: 1. Check the password against the haveibeenpwned.com database. 2. Check the password with the zxcvbn password strength library. If it passes both they can use it. It's not perfect, but it's a lot better than nothing.

I don't think checking against haveibeenpwned is a good idea. They recommend against checking your current password, and you're automatically checking every users current password?

Re: Password expiration is dead, long live passwords

#85

Post by mnm1 » Sun, Jun 02, 2019, 11:37 PM UTC

Great but this still exists in outlook online, Amazon, and probably other places. If Microsoft is really serious about this, they would get rid of password expiration everywhere. It actually leads to less secure passwords as combined with their shitty ui and multiple password change systems, each with its own password rules (another stupidity that needs to die), it leads one to ignore the password generator and manager and just use a simple password that can be remembered and changed by one number when it expires. This way I'm not updating multiple clients constantly and can actually change the password on the first try. I'm glad such insecure and stupid practices are finally going away.

Re: Password expiration is dead, long live passwords

#86

Post by asimops » Sun, Jun 02, 2019, 11:38 PM UTC

omh wrote: post #26

LeoPanthera wrote: post #23

Earlier quoted context omitted.

What I do: 1. Check the password against the haveibeenpwned.com database. 2. Check the password with the zxcvbn password strength library. If it passes both they can use it. It's not perfect, but it's a lot better than nothing.

How are you implementing these checks? I'm using Active Directory and options for extra password checks are somewhat limited.

You can use a dll to do additional security checks on a domain controller base. Check this https://github.com/JacksonVD/PwnedPasswordsDLL-API

Re: Password expiration is dead, long live passwords

#87

Post by jeremyjh » Sun, Jun 02, 2019, 11:51 PM UTC

air7 wrote: post #80

jeremyjh wrote: post #17

Earlier quoted context omitted.

I came here to say this. I can't think of another way to guarantee that they aren't using the same password that they use on every website they've visited since 1997. If anyone has suggestions on this I'd love to hear it.

I disagree. I feel it's not a site's responsibility to stop users from reusing their passwords if they choose to. It has no relation to the security of the service. As a metaphor, a good lock maker protects their customers from lock picking, not from a key left under the mat. Personally, I reuse a simple password for very non-important services and it's very convenient. I think that's ok, or at the very least I shoul…

I've never heard of a website implementing something like this. Password rotation requirements are usually found in corporate or government settings, for logging into your workstation, email and internal applications.

Re: Password expiration is dead, long live passwords

#88

Post by XorNot » Sun, Jun 02, 2019, 11:53 PM UTC

jsonau wrote: post #79

Another worst offender are security questions to unlock accounts. Answers to these questions are usually visible to customer service reps and similar set of questions are asked among different services. This is scary. It's dangerous as having password stored in plain text as answers to the security questions can potentially unlock many other accounts. I highly suggest everyone answers each of them with a unique answe…

I've long since started just putting in random password strings for these.

Re: Password expiration is dead, long live passwords

#89

Post by jupp0r » Sun, Jun 02, 2019, 11:54 PM UTC

yaks_hairbrush wrote: post #47

jupp0r wrote: post #32

Earlier quoted context omitted.

Not sure about the legality of this, but trying to log in to a a couple of services would be an easy test.

A secure service wouldn't have an easy way of getting at a user's password. They'd store the salted hash of a user's password, and not the password itself.

You mean hash it in the browser? That's rare. Otherwise, you have the plain text password in the request you do the hashing and writing the hash to storage in.

Re: Password expiration is dead, long live passwords

#90

Post by Wowfunhappy » Sun, Jun 02, 2019, 11:54 PM UTC

pedrocx486 wrote: post #82

Wowfunhappy wrote: post #57

Earlier quoted context omitted.

Require all employees to use a password manager?

And spend time training them on using it? I really wish it was a thing but people looked at me like I was an alien when I mentioned it... (I work for a Microsoft subsidiary. I also hope they adopt the new rules, I hate changing passwords every 90 days.)

I don't think it's actually possible to both (A) use unique passwords and (B) not use a password manager. If you can't provide one, don't expect the other.