Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password expiration is dead, long live passwords

techcrunch.com

Post reply on HN
Print view View original

91–100 of 316 posts

Re: Password expiration is dead, long live passwords

#91

Post by browningstreet »

Recent, frustrating example: My (business) bank uses FISERV software, and their software expires passwords every 90 days. Their software can notify you about a million combinations of account activities and statuses, except this one. It takes 3 values to login to the account (company ID, username, password). When logging in via mobile app, it never tells you that your password has expired, so I end up trying a few times before I remember it might be an expired password.

Login via web browser, and sure enough it'll tell me my password expired and it's time to change it. They also occasionally enforce 2FA. Passwords are also how you connect things like Quickbooks.

When I called the bank to find out how to get notifications that a password has expired, they said there was no way. "When you change your password, set a calendar event for 60 days ahead..." they told me.

Re: Password expiration is dead, long live passwords

#92

Post by dredmorbius »

discreditable wrote: post #27
cjensen wrote: post #18

Earlier quoted context omitted.

That's amusing but... those same users are likely to be using just altering their passwords a little like "passwd1" "passwd2", etc. You aren't gaining anything.

I'm sure they are, but I think predictability is slightly less bad than being distributed across every single service they've ever used. There's only so much I can do about people not giving a crap.

Testing against known password lists is a huge win.

Re: Password expiration is dead, long live passwords

#93

Post by Someone1234 »

XorNot wrote: post #88
jsonau wrote: post #79

Another worst offender are security questions to unlock accounts. Answers to these questions are usually visible to customer service reps and similar set of questions are asked among different services. This is scary. It's dangerous as having password stored in plain text as answers to the security questions can potentially unlock many other accounts. I highly suggest everyone answers each of them with a unique answe…

I've long since started just putting in random password strings for these.

I used to also, until this blew up in my face.

Put random stuff as the security answers in my Trial World of Warcraft account in 2005. In order to merge it into my Battle.net 2.0 account around 2009 I needed to know it, and even though I had the correct password there was no way to change security questions and I had to beg customer support (which was a long process, involving software serial numbers, scans of ID, the whole works).

Ultimately they told me what my mother's maiden name was: qewqewdfskjr3924kjasdf

Re: Password expiration is dead, long live passwords

#94

Post by dredmorbius »

noobermin wrote: post #58
scarejunba wrote: post #29

Earlier quoted context omitted.

The real problem? People introduce password expiration to improve security, but the means of producing a new unexpired password after being locked out is less secure than the password itself creating a net loss in security.

How did this idea of expiring passwords arise in the first place? Misguided intuition or did the infosec people back then just get it wrong?

It's existed in some form since at least the 1990s, likely through institutional or government practice.

A (possible) example from a 1997 Sybase manual: https://books.google.com/books?id=GzGuPO5fKOEC&q="password+e...

I just checked Simpson & Garfinkel's PUIS, which does mention forced changes, but not scheduled expiry. Also 1997.

(Google Book Search is badly polluted by mis-dated publications: http://www.google.com/search?q="password+expiration"&lr=lang... )

Ngram plot: https://books.google.com/ngrams/graph?content=password+expir...

Re: Password expiration is dead, long live passwords

#95

Post by ClassyJacket »

tzs wrote: post #52
LeoPanthera wrote: post #20

Earlier quoted context omitted.

I briefly worked at a place that enforced quarterly password changes and I literally used as my password. I am not good at remembering passwords and I don't think I'm that unusual. Writing them down seemed worse than using a poor password that I can at least remember. Probably these days if forced I would use . I don't know how much better that is. But luckily now I work for myself.

How often have you had information stolen off a credit card, passport, driver's license, insurance card, or other item with sensitive information printed on it that you routinely carry around in your wallet? For most people, the answer is "never". We are actually quite good at safely keeping secrets on paper in our wallets, and so generally writing down a password and keeping it there is fine, especially if the choic…

Plus if your wallet gets stolen, you will know someone potentially has your password, and change it.

Re: Password expiration is dead, long live passwords

#96

Post by Sendotsh »

jsonau wrote: post #79

Another worst offender are security questions to unlock accounts. Answers to these questions are usually visible to customer service reps and similar set of questions are asked among different services. This is scary. It's dangerous as having password stored in plain text as answers to the security questions can potentially unlock many other accounts. I highly suggest everyone answers each of them with a unique answe…

I answer these with random wrong answers and add the question/answer combo to the Notes section in my password manager.

Don’t just mash the keyboard or use random strings, as customer support will regularly accept “I don’t remember, I just put random stuff”. Make it believable but wrong.

Re: Password expiration is dead, long live passwords

#97

Post by MaxGabriel »

dessant wrote: post #24

That's exciting news, though it will take a couple of years until it trickles down to financial institutions. My bank forces me to change passwords every 3 months, and of course they also disable pasting for added security. We also have a local utility that sends you a 5 letter password upon account creation through email, and that's your password. If you try to change it, they'll send you another 5 letter one.

If you're in need of business banking, you can use mercury.co (my company) and enjoy unlimited length, non-paste-breaking, password manager compatible, no expiration, no character restriction passwords + non-SMS based 2FA :)

Hopefully we have five years before competitors catch up to us and implement this cutting edge technology!

Re: Password expiration is dead, long live passwords

#98

Post by setr »

Retric wrote: post #70
thaumasiotes wrote: post #64

Earlier quoted context omitted.

> If a password is never stolen, there’s no need to expire it. And if you have evidence that a password has been stolen We've been seeing the point "your personal information is already out there, in the hands of hackers" recently. This cleft seems oddly blind to the possibility that a password has been stolen, but you have no evidence of the fact.

If that’s the fear then all passwords should expire at the same time. Otherwise if you reset every X days, hackers will always have access to some accounts X days.

In the current method, possible access risk is staggered, such that you only have access to some accounts, for some days.

In your method, you have access to all or none, for some days.

Staggered seems preferable.

Note that I’m only arguing your reasoning, not the broader point of password expiration

Re: Password expiration is dead, long live passwords

#99

Post by erichurkman »

tty2300 wrote: post #45
paulryanrogers wrote: post #43

Earlier quoted context omitted.

Some never memorize their passwords at all. Instead relying on 'forgot' emails and "Remember Me" features entirely.

Which isn't even that bad of an idea. Some website basically use this as the only way to log in.

Slack does this exceptionally well. If you forget which accounts you have, you can put in an email address and it will email you a list of your Slack accounts. If you forget your password, you can get a magic link that automatically signs in through a deep link into the app, no password needed.

Re: Password expiration is dead, long live passwords

#100

Post by lone_haxx0r »

Raistael wrote: post #3

I'm not entirely sure that I'd agree with this mentality. Sure, at a glance it sounds good. If the password has been safeguarded, there's really not much reason to force expiration. However, wouldn't the age of the password reduce the security of it by default? The longer a password exists for, the more likely it is that it can be cracked, discovered by a misplaced Post-It note, or compromised by some other unknown s…

Even if that natural decline in security was significant, it wouldn't be as significant as the insecurity introduced by forcing the user to change it.
Post reply on HN