Frequent Password Changes Is a Bad Security Idea
schneier.com
Frequent Password Changes Is a Bad Security Idea
1–10 of 59 posts
Re: Frequent Password Changes Is a Bad Security Idea
#2Does anyone aside from HN type folks listen to these recommendations?
I just had a major banking institution send me a plaintext pw instead of reset token, with a 15 char limit, and a rotation requirement.
Re: Frequent Password Changes Is a Bad Security Idea
#3I think password + security tokens is a more common way to go nowadays, when you need to access externally.
Re: Frequent Password Changes Is a Bad Security Idea
#4Tell that to Wells Fargo commercial.
12 character max, change every other month.
Re: Frequent Password Changes Is a Bad Security Idea
#5I also hate to have to mandatory change my password. I am paranoid, never used 2 times the same password for somewhat important account and have a mental trick system to remember my password. When asking for a password change, it's fucking it up. Looking at you Linkedin and Paypal. Thansk for crappy security and annoying password policy.
Re: Frequent Password Changes Is a Bad Security Idea
#6For those who work at corporations with password rotation policies, it may actually be a good way to get creative. This guy changed password rotations into a lifehack:
https://medium.com/the-lighthouse/how-a-password-changed-my-...
Previous discussion on it: https://news.ycombinator.com/item?id=8015470
Re: Frequent Password Changes Is a Bad Security Idea
#7I usually just make up a crazy long sentence I'll remember, with no logical order in it. Something funny to me so I'll easily remember it. Throw in some assortment of numbers and symbols. Bam! Works like a charm!
Re: Frequent Password Changes Is a Bad Security Idea
#8There is also the matter of cost-benefit analysis of time spent updating passwords. Where I work we have a special code that has to be typed in by logged in members of the team if they want to really delete a transaction, this code is the same for all members of the team. A manager sets this code to expire on a monthly basis because a new code will be good for security, apparently. In reality this means that on the first of each month a team are locked out for an hour or two whilst the new code gets generated and circulated - in email. So there is a misunderstanding on security plus an implementation issue leading to disruption equivalent to the loss of a person's productivity for a day.
A similar scenario of disruption happens if you use lots of devices and need to update a password on several boxes to get working again. There may not be the communication overhead of my special code analogy (which is invariably delayed due to waiting for the manager to get out of meeting), however there is still disruption and time taken out from the task in hand.
As an aside, I like 'ambient' passwords, e.g. the VAT number on the receipt that you got given buying your lunch, the receipt can be kept in the top drawer - safe from the cleaner - and, if it is lost, you can go to the shop again to get another receipt.
Re: Frequent Password Changes Is a Bad Security Idea
#9It's a double sword. The true issue with frequent password change is people really don't want to be creative. They ended up either changing one letter, or adding an extra letter. At least do a quick distance check and deny password at 90% similarity.
Re: Frequent Password Changes Is a Bad Security Idea
#10Tell that to Wells Fargo commercial. 12 character max, change every other month.
Yeah. 12 is quite silly. It should be at least, arbitrarily, 45 chars max. I mean, 45 chars would be enough for a passphrase...