4 ms·

I think this is silly. Anecdotally, I've had good success forcing longer passwords while at the same time, introducing people to password managers. Doing only

I think this is silly. Anecdotally, I've had good success forcing longer passwords while at the same time, introducing people to password managers. Doing only one or the other does not have the same uptake but we recently went through and forced everyone to reset their passwords. We're now up to 16 chars, I'd like to get to 30 (or to a point where it's a pain to type it in) but baby steps, I suppose.

csydas 9y ago
We took a different approach at my last job when we revisited our entire identity management approach. We were a University with Federated logins across a few dozen system, and our password rules had honestly spiraled out of control because the system hadn't been constructed in such a way to restrict access easily. During the rework, we focused on a few things primarily: 1. Reduce password complexity, enforce legnth 2. Restructure account creation around least-privilege principal, so that access had to be granted, not just created during account creation, and also allow fast and easy addition and removal of access to system as part of the Management System 3. Revisit password expiries based on level of access and relative strength of password (as determined by zxcvbn) Students and low level staff loved it - if you had a standard account and didn't have any access to anything sensitive that didn't belong to you, your password could sit untouched for up to 2 years I think if it met the strength requirements. Those with access to actual sensitive data (student records, finances, etc), were held to a higher class of password complexity and would suffer a rotation penalty if they didn't have a sufficiently complex password; this mostly did away with the number of people with very common passwords, though it didn't go without a lot of fighting for some of the administrators, which, as I remember the discussions anyways, were more pride issues than anything. We used that as an opportunity to roll out password managers
- kevhito 9y ago
  Can you back up these recommendations with actual studies or research papers? Or are you just making up your security strategy by gut instinct here?
  - ScottBurson 9y ago
    Even if it's the latter, they're actually thinking about what they're trying to protect and what system would work best to protect it. That has got to be an improvement on the mindless, cargo-cult approach to security that most organizations take.
kevhito 9y ago
Really. The article cites NIST and one scientific study (of which there are many). And your response is "Anecdotally..." ?
dsacco 9y ago
Why do you think it's silly? There are only two reasons to change a password: 1. The cover time (expected duration of secrecy) is about to expire, either due to advances in technology or because it was too small to begin with; or 2. The password was compromised and is no longer secret. If a password has not been compromised and is sufficiently strong as to not be crackable without a server farm and hundreds of thousands of years, it doesn't make sense to change it.
snakeanus 9y ago
Why not just move to public key authentication then?

csydas 9y ago

We took a different approach at my last job when we revisited our entire identity management approach. We were a University with Federated logins across a few dozen system, and our password rules had honestly spiraled out of control because the system hadn't been constructed in such a way to restrict access easily. During the rework, we focused on a few things primarily: 1. Reduce password complexity, enforce legnth 2. Restructure account creation around least-privilege principal, so that access had to be granted, not just created during account creation, and also allow fast and easy addition and removal of access to system as part of the Management System 3. Revisit password expiries based on level of access and relative strength of password (as determined by zxcvbn) Students and low level staff loved it - if you had a standard account and didn't have any access to anything sensitive that didn't belong to you, your password could sit untouched for up to 2 years I think if it met the strength requirements. Those with access to actual sensitive data (student records, finances, etc), were held to a higher class of password complexity and would suffer a rotation penalty if they didn't have a sufficiently complex password; this mostly did away with the number of people with very common passwords, though it didn't go without a lot of fighting for some of the administrators, which, as I remember the discussions anyways, were more pride issues than anything. We used that as an opportunity to roll out password managers

kevhito 9y ago
Can you back up these recommendations with actual studies or research papers? Or are you just making up your security strategy by gut instinct here?
- ScottBurson 9y ago
  Even if it's the latter, they're actually thinking about what they're trying to protect and what system would work best to protect it. That has got to be an improvement on the mindless, cargo-cult approach to security that most organizations take.

kevhito 9y ago

Really. The article cites NIST and one scientific study (of which there are many). And your response is "Anecdotally..." ?

dsacco 9y ago

Why do you think it's silly? There are only two reasons to change a password: 1. The cover time (expected duration of secrecy) is about to expire, either due to advances in technology or because it was too small to begin with; or 2. The password was compromised and is no longer secret. If a password has not been compromised and is sufficiently strong as to not be crackable without a server farm and hundreds of thousands of years, it doesn't make sense to change it.

snakeanus 9y ago

Why not just move to public key authentication then?