Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

There’s no need to change passwords if they're robust, unique and not breached

tidbits.com

Post reply on HN
Print view View original

91–100 of 288 posts

Re: There’s no need to change passwords if they're robust, unique and not breached

#91

Post by kube-system »

chimeracoder wrote: post #29
ejb999 wrote: post #20

I am in the camp of requiring people to have strong passwords, and not requiring them to be changed - ever. When you ask people to remember too many passwords, they start writing them down and/or forgetting them, which leads to other problems. My oldest online account - btw it is a brokerage account at one of the big brokerage houses, where a great deal of my cash and investments sit - has not asked me to change the…

> When you ask people to remember too many passwords, they start writing them down and/or forgetting them, which leads to other problems. Writing passwords down isn't the worst thing. If you can't convince someone to use a password manager like 1Password, getting them to use a physical notebook of unique and strong passwords is actually the next best thing, because (combined with 2FA) it protects them against the mos…

> Writing passwords down isn't the worst thing.

At home maybe, but in other environments this can be pretty bad.

Re: There’s no need to change passwords if they're robust, unique and not breached

#93

Post by dylan604 »

cromd wrote: post #81

Worth keeping in mind that passwords do actually leak. Companies have had incidents where they were inadvertently logging secrets passed to them. I've also typed/pasted secrets in the wrong field, which can get into some database or user-interface tracking tool. I've typed my sudo password instead of a vpn password at the command line, thinking sudo login had triggered when it was instead cached. Who knows when these…

If you do not reuse passwords and one of them does leak, then the only thing affected is the site/service that was compromised. Hence the word "unique" in the title.

Re: There’s no need to change passwords if they're robust, unique and not breached

#94

Post by iso1631 »

falcolas wrote: post #66
iso1631 wrote: post #58

Earlier quoted context omitted.

Vast majority of passwords will have just 1 symbol, either at the start or end, or replace A with @, S with $, etc P@55w0rd! Is an awful password, yet meets many security policies P@ssword2, P@ssword3, P@ssword4 etc Also meet them, and rotate just fine. Meanwhile dadbffc67f798e8e0b7441fb995aeabe Is perfectly fine, but often is not allowed

> Is perfectly fine, but often is not allowed Nor is "correct horse battery staple". For wanting symbols, so many password systems really hate spaces.

correct horse battery staple is a terrible password :D

Re: There’s no need to change passwords if they're robust, unique and not breached

#95

Post by dylan604 »

falcolas wrote: post #66
iso1631 wrote: post #58

Earlier quoted context omitted.

Vast majority of passwords will have just 1 symbol, either at the start or end, or replace A with @, S with $, etc P@55w0rd! Is an awful password, yet meets many security policies P@ssword2, P@ssword3, P@ssword4 etc Also meet them, and rotate just fine. Meanwhile dadbffc67f798e8e0b7441fb995aeabe Is perfectly fine, but often is not allowed

> Is perfectly fine, but often is not allowed Nor is "correct horse battery staple". For wanting symbols, so many password systems really hate spaces.

I can't tell you how pissed I was when the ex-Pres revealed my password with his "Man Woman Camera TV" rant.

Re: There’s no need to change passwords if they're robust, unique and not breached

#96

Post by rgoulter »

harryvederci wrote: post #74
simonbarker87 wrote: post #62

For people who have to change their password regularly I suggest just adding the month and year in numbers at the end of whatever password they like to use. That way there is a clue in the current month and year as to what their password probably is should they forget

If a hacker found an old password of yours, the month an year would be a pretty easy indictor of what to try next, right?

It's a trade-off of convenience vs security.

If you're worried a password will leak, how frequently should you rotate it to maintain security? e.g. Even rotating yearly still seems a chore if you do it for websites you don't frequently visit (such as sites you made 1 order from).

The "add YYMMDD" or whatever is a way of working around a policy which automatically enforces a more frequent rotation than you want.

Re: There’s no need to change passwords if they're robust, unique and not breached

#97

Post by Brian_K_White »

One missed point, the advice is even slightly better than they argue, since they only argue that it's not necessary to change it, which is just an argument of convenience.

But updating a password is itself an attack surface. More so than merely using it to log in.

It's one of the times where an attacker may be tricking you into giving it to them, either by a fake page or app dialog, or in concert with maybe they have a way to receive the verification email or text.

Also it's a less frequent operation, meaning it's easier to fake. You are more likely to notice any tiny discrepency and detect a fake in the way your normal login screen looks than some account management screen.

Basically updating a password is a riskier action than the normal daily use of the same password.

And that alone is it's own even stronger argument for avoiding doing it unnecessarily.

Re: There’s no need to change passwords if they're robust, unique and not breached

#98

Post by pkilgore »

UltraViolence wrote: post #44

I use Password Safe, an open-source password database. I highly recommend it for people that are more computer savvy. For the digital illiterates OnePass may be more suitable.

"digital illiterates" is quite a take there when any password manager is involved.

Re: There’s no need to change passwords if they're robust, unique and not breached

#99

Post by jmyeet »

I hate password rotation rules. Companies have iT departments that love nothing more than to add "value" by adding their own spin on what password security should be. It's pure security theater.

At every company I've ever worked that required password rotation, everyone just incremented a digit, usually at the end.

I also hate the completely arbitrary rules on length (I mean, why do some sites have a maximum length?). Some require uppercase and lowercase as well as digits and certain special characters and what special characters are allowed is inconsistent and completely arbitrary.

We need to focus on how much entropy [1] a password has without arbitrary rules. 20 lowercase letters is going to be better than a 7 letter dictionary word with one letter capitalized and a number of symbol on the end. In fact pretty much every password 8 characters of length should be considered cracked. 10 should probably be the absolute minimum.

[1]: https://xkcd.com/936/

Post reply on HN