8 ms·
Recommending not expiring based on time is probably my favourite. I've worked at two places where that's been a requirement and my password has always been a pa
by lucaspiller 10y ago
Recommending not expiring based on time is probably my favourite. I've worked at two places where that's been a requirement and my password has always been a passphrase combined with a sequencial number.
- adrr 10y agoPCI compliance requires quarterly rotation of passwords and keys.
- ddlatham 10y agoThis recommendation may perhaps be a step to getting those compliance rules changed.
- sib 10y agoNothing better than rules based on bad data and security theater.
- sp332 10y agoIf your password is compromised, it will only work until the next reset. That's better than having one that works for years.
- nitrogen 10y agoIf your password is compromised, you've already lost. Since password rotation policies incentivize weak passwords, they are more likely to result in a compromised password. Thus, password rotation with weak passwords is not better than a single strong password that is never rotated.
- phire 10y agoNow that I think about it "Don't worry about detecting attackers, they will get kicked out when we next rotate passwords" is not an attitude you want anyone to develop.
- nitrogen 10y agoPlus, chances are pretty good that if they compromised one password undetected, they can compromise the next one in the same way (spear phishing, malware, etc.).
- rconti 10y agoThat's true, but I'm having hard time thinking of a use case where a sustained, hidden compromise is 'worse' than a one-time compromise. I mean, I guess they could login to your bank every week and transfer out $50 instead of just transferring out all your money on day 1, but... ?
- mschuster91 10y agoI have previously worked in the gambling industry. The worst nightmare of any gambling device manufacturer is a group of people that discover a bug and exploit it on small scale - no one will bat an eye and investigate if a machine pays out 50 bucks more or less. However, in most cases people are dumb, greedy or the combination of both - e.g. in February 2014, a concerted mass hack occurred across Germany and over 10M € were reported as losses (http://www.spiegel.de/spiegel/print/d-126511954.html http://www.spiegel.de/spiegel/print/d-126511954.html), and most other bugs surface fairly quickly because people exploit them until the machines run dry and the owner/manufacturer inspects them. So, in the case of gambling machines/casinos, a small-scale hidden compromise is far worse than a "big blow" - thankfully for the industry, greed usually prevails over common sense.
- bsilvereagle 10y agoThere are quite a few scenarios where a sustained, hidden compromise is an (or several) order of magnitude worse than a one time obvious compromise. The first to come to mind is a corporate espionage scenario. Do you want to know what your competitor is up to today, or do you want access to their briefings/CAD/code for the next 12 months? Long duration compromises also allow you to slip data out slowly, so a NAS doesn't show 200GB being transferred off in a matter of hours, but a slow drip of 100MB a day. At a personal/home use level, long term access to a bank account allows an attacker to build up a spending profile, which depending on your habits, could be used for blackmail.
- Spooky23 10y agoThe reality is that passwords are being deprecated as strong security boundaries. We've been working under this fantasy that it's acceptable to make a "strong" password and have a meaningful expectation that you can maintain the security and integrity of access. Multi factor authentication is the best solution to this problem -- a moderately complex password with MFA is stinger than a password. If you want to compromise somebody long-term, you move laterally within the targets network and infect multiple devices.
- freehunter 10y agoUnless you can only change on a pre-defined interval, the attacker can always change your password for you to avoid being locked out. I don't know many users who would complain their their password seemingly never expired.
- mark-r 10y agoThese are often combined with a requirement to not reuse some number of recent passwords, so the attacker can't change the password right back again. When you can't log in then your password will be reset and they've lost access.
- freehunter 10y agoThat's true, I hadn't thought of that. Holiday week has my brain off in the clouds.
- syshum 10y agoThat is the entirety of PCI PCI is nothing more than Security Theater so Mastercard and visa can claim it is all the merchants fault for data breaches and shield them from any liability
- zeroer 10y agoCredit card numbers themselves are security theater.
- ma2rten 10y agoNot half as bad as Social Security Numbers.
- dfox 10y agoSSNs are identifiers and when knowledge of SSN gets you some privileges, it's problem with whatever gives you these privileges. Card numbers are on the other hand essentially explicitly designed to be used as authentication data and at the same time printed in big letters on the card and known by all parties involved in transaction.
- zeroer 10y agoThey're both pretty bad.
- chris_wot 10y agoMy passwords are always surprised or overly enthusiastic. MyPassword123! Soon becomes MyPassword123!! And then as I progress in the company my enthusiasm gets even more hyper MyPassword!!!!!
- woliveirajr 10y agoIt's fun to know that almost every requirement usually gets solved by capitalizing the first letter, by prefixing or postfixing the number 1, but using the "!"... and that's what the majority does.
- tzs 10y agoWhere does it require quarterly rotation? I'm not seeing any specific time limit in the PCI DSS, but I could have overlooked it.
- monkeywork 10y agoI thought PCI compliance required you to follow A standard (they didn't dictate which one) as long as it was a recognized industry standard and you were consistent with it. NIST would qualify...
- CWuestefeld 10y agoWe're going through various audits for PCI right now. Our auditor insisted that we need to add checks for reuse of recent passwords. However, I've heard that the process varies widely depending on who your auditors are. Some are apparently very permissive, but we got the other end of the spectrum.
- ColinDabritz 10y agoI also love that one. I am not yet finding the specific citation in the actual linked repo. I would appreciate it if someone could point it out!
- undersuit 10y agoWe have a script that updates our passwords for some automated processes. So let's just increment a number inside the password every month with some perl! /^(.*?)(\d+)(.*?)$/
- unpythonic 10y agoLove the /e for executing the substitution $ echo abc9def | perl -pe 's/(\d+)/$1+1/e' abc10def
- numbsafari 10y ago"Autumn2016!"... ftw!
- deleted 10y ago[deleted]
- cmsmith 10y agoI worked at NIST until recently, and my password expired every 90 days. We also had separate passwords for a half-dozen legacy IT systems (timesheets, travel requests, IT support, etc), all with more stringent and senseless length/character requirements than the last. And password managers were not allowed per security policy. It was frustrating.
- developer2 10y agoAt my last employer, my standard corporate password ended in a '4'. Due to muscle memory, incrementing it to a '5' didn't work so well. Instead, I just started repeating that final character every couple of months when the forced password change came around. My password wound up being "<main-password>4444444". Was always a little mystified that I could hammer out seven 4's without counting them faster than I could remember that I was at a suffix increment of "10" or "11".
- discreditable 10y agoI like the rule but enforce a yearly password change in my Windows environment. I'm just a little paranoid about cached credentials living on machines for long periods of time.
- iamatworknow 10y agoI'm guilty of this as well. Just a week or two ago I went up to 23. Adding one for the first period when I had no number on the password, (90 * 24)/365.25 = 5.91 years I started the first week of December, 2010.