9 ms·
Frequent Password Changes Is a Bad Security Idea
- lips 10y agoDoes anyone aside from HN type folks listen to these recommendations? I just had a major banking institution send me a plaintext pw instead of reset token, with a 15 char limit, and a rotation requirement.
- eitland 10y agoI raise with a big client that reset my password to CompanyName123 and didn't let me change it.
- perlgeek 10y ago> Does anyone aside from HN type folks listen to these recommendations? Probably not. But if you work as a contractor for somebody with non-sensical requirements, at least you have some research that you can link to to support your point.
- steve371 10y agoI think password + security tokens is a more common way to go nowadays, when you need to access externally.
- jwatte 10y agoTell that to Wells Fargo commercial. 12 character max, change every other month.
- yeukhon 10y agoYeah. 12 is quite silly. It should be at least, arbitrarily, 45 chars max. I mean, 45 chars would be enough for a passphrase...
- timmytokyo 10y agoIf they nave a maximum pw length, they probably have a significant aecurity issue. Namely, they are likely not storing a hash.
- hartator 10y agoI also hate to have to mandatory change my password. I am paranoid, never used 2 times the same password for somewhat important account and have a mental trick system to remember my password. When asking for a password change, it's fucking it up. Looking at you Linkedin and Paypal. Thansk for crappy security and annoying password policy.
- MAGZine 10y agoFor those who work at corporations with password rotation policies, it may actually be a good way to get creative. This guy changed password rotations into a lifehack: https://medium.com/the-lighthouse/how-a-password-changed-my-life-7af5d5f28038#.dlynk50b7 https://medium.com/the-lighthouse/how-a-password-changed-my-... Previous discussion on it: https://news.ycombinator.com/item?id=8015470 https://news.ycombinator.com/item?id=8015470
- LionRoar 10y agoThanks for the link, I reread it. Nice story but I think I can guess his current password now: "Plus, if you’re interested in more of this, I’m writing a book!" :)
- 0xmohit 10y ago> Write these statements with the right mindset and attitude, and you’ll change your life. I hope that the passwords thus created emerge from good thoughts and not otherwise.
- wglb 10y agoWe used this story in our security awareness training. Great approach.
- joeskyyy 10y agoI usually just make up a crazy long sentence I'll remember, with no logical order in it. Something funny to me so I'll easily remember it. Throw in some assortment of numbers and symbols. Bam! Works like a charm!
- adrianN 10y agoThen the sysadmin hits you with a "at least 8 characters, no more than 13, one uppercase, one lowercase, a number, a special character, but not one that can't be encoded in EBCDIC and the password must differ in at least three places from the last 10 you used."
- cafard 10y agoAh. Last Friday at work I changed my password. It worked fine when I unlocked my computer after stepping away. On the way home, I noticed that my iPhone wasn't updating email, and recalled that I hadn't changed the password there. But I could not get the iPhone to accept my password. Nor could I get Outlook webmail to accept it. I was afraid that I might have to trouble one of the network admins, but I tried the VPN client. That accepted the password. I RDPed into a machine on the internal network, changed the password to something a little shorter, and confirmed that Exchange was OK with it. As I recall, the boundary was somewhere around 20 characters.
- Theodores 10y agoThere is also the matter of cost-benefit analysis of time spent updating passwords. Where I work we have a special code that has to be typed in by logged in members of the team if they want to really delete a transaction, this code is the same for all members of the team. A manager sets this code to expire on a monthly basis because a new code will be good for security, apparently. In reality this means that on the first of each month a team are locked out for an hour or two whilst the new code gets generated and circulated - in email. So there is a misunderstanding on security plus an implementation issue leading to disruption equivalent to the loss of a person's productivity for a day. A similar scenario of disruption happens if you use lots of devices and need to update a password on several boxes to get working again. There may not be the communication overhead of my special code analogy (which is invariably delayed due to waiting for the manager to get out of meeting), however there is still disruption and time taken out from the task in hand. As an aside, I like 'ambient' passwords, e.g. the VAT number on the receipt that you got given buying your lunch, the receipt can be kept in the top drawer - safe from the cleaner - and, if it is lost, you can go to the shop again to get another receipt.
- yeukhon 10y agoIt's a double sword. The true issue with frequent password change is people really don't want to be creative. They ended up either changing one letter, or adding an extra letter. At least do a quick distance check and deny password at 90% similarity.
- Retra 10y agoOh, yeah. They'll never just write it down if you do that.
- abstractbeliefs 10y agoIf everyone in the office wrote down their secure password and stored it in a locked desk drawer, that's probably more secure than the entire office using weak passwords. If nothing else, it means the person has to have physical access and be able to pass off rifling through someones desk after breaking it open. While this sort of stuff has happened in on-premise pentests, it's certainly not the normal way to attack when it's done for real.
- snuxoll 10y agoNot news to anyone in the security scene, especially as a 30-90 password lifetime disincentives people from actually creating a complex password so they'll do stuff like Sp0useName02 that technically meets the complexity requirements, but is horrendously insecure.
- bambax 10y agoAt a client's who requires frequent password changes, people simply write out their passwords on post it notes that they stick onto their screens. Some security. (That's a bank, by the way).
- Tempest1981 10y agoOTOH, maybe coworkers are more trustworthy than external hackers running cracking tools? Might be true at some companies... (I still hate being forced to change passwords.)
- cesis 10y agoSchneier actually recommends writing down passwords https://www.schneier.com/blog/archives/2005/06/write_down_your.html https://www.schneier.com/blog/archives/2005/06/write_down_yo...
- toomanybeersies 10y agoI'd say that for most people, their physical security is stronger than their digital security. Obviously sticking it on your screen is a terrible idea, but if it's in a drawer (especially a locker one), it's probably not going to get stolen, especially not in a bank.
- Sean1708 10y agoFrankly that's a hell of a lot more secure than using the same password to access both facebook and your (possibly confidential) company account.
- mchahn 10y agoFeynman used to break into safes (he had a non-evil reason). His main technique was looking for notes in the person's desk with the combination. Everyone thought he was a "safe-cracker".
- Tempest1981 10y agoI would guess that phishing works better than password guessing. Not arguing for weak passwords, just thinking big picture.
- 0xmohit 10y agoTrue. Unless you have the same password across a dozen sites.
- ashitlerferad 10y agohttps://en.wikipedia.org/wiki/Diceware https://en.wikipedia.org/wiki/Diceware
- dguest 10y agoDoes anyone actually have data showing that frequent password changes lead to better security? Because to me requiring frequent password change seems like the ultimate non-technical management blunder: management wants to say they did something to prevent hacks, so they ask IT to require password changes; IT doesn't want to be blamed so they implement it; users comply with the requirements but can't remember their new password (and don't really care about the company's security in the first place), so they come up with something insecure and keep it somewhere even less secure.
- koolba 10y agoIn most cases at best it's neutral and at worst it creates a pre-scheduled phishing opportunity. Alice gets an email saying, "Reminder: Your password will expire needs to be updated" and she cheerfully complies.
- 0xmohit 10y agoI suspect that the requirement of (1) changing the password every n days, (2) new password cannot be the same as previous m passwords (usually, m=10) leads to insecure passwords for most. I've seen people handle such requirements by creating an initial password, say p@$$w0rd and then appending a digit to it. On any subsequent mandatory password change event, they increment the new password from p@$$w0rd0 to p@$$w0rd1. Not sure if it leads to anything more secure. Wish more people started to use GPG based password store such as pass [0]. [0] https://www.passwordstore.org/ https://www.passwordstore.org/
- barrkel 10y agoI usually deal with this by appending the month and year of the change to a secure password. Broken if the secure password is revealed, but no less secure than no rotation policy. Where I work, we change passwords every 90 days, but every password other than full disk encryption, login and password manager are auto generated by password manager, so this mechanic is less of a concern.
- angrow 10y agoI have worked at a US DoD "secure facility". You can imagine the requirements they imposed on password length, characters, frequency of changing, uniqueness, etc. Perhaps you can also imagine that nearly everyone kept their current password written on a sticky-note somewhere in their desk.
- tombooth 10y agoThis is echoed by CESG (part of GCHQ) in their password guidance: https://www.cesg.gov.uk/guidance/password-guidance-simplifying-your-approach https://www.cesg.gov.uk/guidance/password-guidance-simplifyi...
- petercooper 10y agoThis reminds me of a story I read about the NHS (National Health Service) here in the UK. Some edict came through that scans had to be stored and accessed digitally. There were numerous teething problems in accessing the system, so a brain surgeon was going nuts running back and forth across the hospital trying to do his work. A nurse in another department said he could use their consultant's login with the password 'fuckoff'. He ran back to his own desk, no go. So he went back and they said, "Ah, he has to keep changing the password each week so try fuckoff45" because the system had been set up almost a year prior. It didn't work, but after realizing more time had passed, he tried "fuckoff47" and it did the trick(!) Note that the problem here wasn't just the password but that sharing entire logins was/is rife. (Update: I've found a reference to the story at https://www.theguardian.com/books/2014/mar/30/do-no-harm-stories-brain-surgery-review-henry-marsh https://www.theguardian.com/books/2014/mar/30/do-no-harm-sto...) (The NHS is full of fun IT-related stories. Another was that due to patient privacy laws, keys to access scans had to be sent under separate transport. So you'd end up with situations where two couriers would be delivering separate USB sticks each to access a single scan.)
- ukj 10y agoTo prevent people doing this just throw in a string similarity algorithm into your password-change UI. if similarity(old_password,new_password) > 50% then reject password change...
- cowsandmilk 10y agoOr just require good passwords in the first place and stop this bullshit.
- JoeAltmaier 10y ago...or stop requiring it altogether.
- tomjen3 10y agoThen I will just change busstop04! to trainstop9? and keep altering between them. Seriously you cannot invent a password scheme where people can choose passwords that will not be vulnerable to this.
- kwhitefoot 10y agoHow does that work? Or, rather, if that can work the system has even bigger problems because you must be storing the passwords in plain text instead of salted hashes.
- Sean1708 10y agoIt could be done on the client if you get them to enter their old and new passwords.
- tzs 10y agoIf they are going to have a "new not similar to old" policy, it should probably be done on the server rather than the client, because the client is less trustworthy. A password change dialog needs to be asking for the old password anyway and then verifying that it is correct to protect against people who step away from logged in sessions having their passwords changed by pranksters or worse. I doubt "new not similar to old" policies actually accomplish much. If they are implemented securely using standard technology they will only be able to check the proposed new password against the current password. That just means that instead of having a sequence of similar passwords, P1, P2, P3, ..., users will have two such sequences interleaved: P1, Q1, P2, Q2, ..., where all the P's are similar and all the Q's are similar but the P's are not similar to the Q's. There's probably a way to do a similarity check between two passwords given just hashes of the passwords (for instance, using homomorphic encryption), but that kind of thing is more research level than deploy live level, I believe. If/when that becomes practical, then a no similarity policy could go back as far as you are willing to keep old password hashes around without being any less secure than a no reuse policy going back as far.
- koolba 10y agoI've never met anyone in the corporate world that does not suffix a digit to their password that increments with each mandatory password change. Most people start with "foobar"[1] then become "foobar2", "foobar3", etc. [1]: Or maybe "Foobar" (because you need a capital letter) or "Foobar!" (because you need a capital letter and a non-alphanumeric letter).
- jjnoakes 10y agoI've never met anyone in the corporate world who can do that; all of the important systems I've seen require the new password to be "different enough" from the old. Appending or changing a couple of digits isn't accepted.
- koolba 10y agoEvery LDAP password policy I've seen only prevents the previous N passwords (usually 5 or 6), requires some combination of upper case, lower case, and numbers, and possibly some punctuation. I've never seen one that actually compares permutations of your prior passwords to check for a minimum change set.
- jjnoakes 10y agoLike I said, that's all I see. I doubt these systems are backed by LDAP, but that's irrelevant.
- koolba 10y agoAre the authentication backends in-house, FOSS, or off the shelf products?
- jjnoakes 10y agoThe backends don't matter. It's the password-changing frontend that has both passwords at change time and makes the call. This isn't about setting the characteristics of a single password, it's about setting the allowed editing distance between them during a password change.
- paulddraper 10y agoThe point of changing your password is to counteract any hacked passwords, I think. But WHY ARE YOUR PASSWORDS BEING COMPROMISED? That's what you need to address.
- dingleberry 10y agohow about $ echo "password" | md5sum 286755fad04869ca523320acce0dc6a4 $ echo "Password" | md5sum 29f33cab54c2a8858885b95d8fbb7ff1 $ echo "PAssword" | md5sum 20a68cafb28eb68e306be529a29a8a62 $ echo "PASsword" | md5sum 2ed0aec406faee855f7739bc94fa60d0