16 ms·

NIST doesn't "Advise Against Periodically Changing Passwords". There is no issue with periodically changing passwords in and of itself. NIST is acknowledging t

NIST doesn't "Advise Against Periodically Changing Passwords". There is no issue with periodically changing passwords in and of itself. NIST is acknowledging that the typical user when faced with a password policy that requires a regular password change will choose a weaker password. NIST is advising against imposing a requirement to periodically reset passwords. Maybe I'm nitpicking but the title as it currently stands is misleading in my opinion.

dsacco 9y ago
I disagree. In principle, every time a password is changed is a point of failure - it's additional overhead that has the opportunity to go wrong. If a password does not need to be changed, don't change it. Set it and forget it. If you generate strong passwords, store them securely in a password manager and use different passwords for each account, you shouldn't need to force a password change unless the password is compromised or technology evolves to make it insecure.
- chronic940 9y ago
  > store them securely in a password manager and use different passwords for each account You are about the 2% of the tech crowd (i.e, bay area software/data people). The vast majority of engineers do not use a password manager, let alone the entire US populace. You severely overestimate the amount the average person cares about password security.
  - wayn3 9y ago
    id much rather have a reasonable solution for widespread 2 factor authentication than this password mess. with my bank i have a password, an app on my phone that generates a key and if i perform significant transactions, they call me to confirm before processing it. the idea that i'm going to use a different password for every stupid site out there that i have an account with is a bit silly. if someone desperately wants to compromise some of them then so be it. hijack my twitter if it makes you feel better. im not going to waste mental energy on securing social media. "just use a password manager" sounds cute. password managers are compromised, too. password managers are about as trustworthy as the people who operate them. theres no way im handing my passwords for bank accounts over to some random company and for passwords that protect pointless internet nonsense, im not going to use one either because its irrelevant. you can invoke this whole "password managers are secure" hoohaa. if they ACTUALLY encrypt your passwords properly and ACTUALLY dont save them on their own servers for whatever they want to do with them later, then yes, they probably are secure. but theres no way to be sure that thats the case. Trusting a password manager introduces more uncertainty into your password woes than they will ever make you more secure, if you really think this whole thing through. the other issue with a password manager is that in theory, they work across platforms. that ends rather abruptly when youre not in a browser and need to enter a password into an app on your phone.
    - interfixus 9y ago
      You seem to be operating under the assumption that all password managers are netbased and commercially operated. This is not the case for PasswordSafe, not the case for the various Keepass implementations out there, and not the case for several other, lesser known projects. I am a happy, contended and reasonably safe KeepassX user since many years ago. While I do see the point of two factor auth in certain situations, I sincerely hop and pray it never takes off in a mandatory big way, uncalled for annoyance as it is in most cases. My 36 character passwords usually do the job just fine.
    - GordonS 9y ago
      > if someone desperately wants to compromise some of them then so be it. hijack my twitter if it makes you feel better. im not going to waste mental energy on securing social media. This is a bit short sited; if you use the same password for everything and your Twitter account gets broken into, then every site where you have the same email address is potentially also broken into
    - defined 9y ago
      You don't need to use a web-based password manager. I use the standalone KeePass app across all my devices, and can paste passwords into apps with no browser access required. I believe KeePass is widely regarded by those who know more than me as cryptographically solid. The only pain point is keeping the databases synchronized across all devices, but it's not that difficult.
  - dsacco 9y ago
    We're talking about best practices; I didn't make any claim about how many people use password managers. The point remains - if you want to follow password best practices and optimize for user safety, don't enforce arbitrary password changes. You're right about ordinary users - we should provide them with fewer opportunities to shoot themselves in the foot. The lower the frequency they have to focus on generating passwords, the better.
  - rietta 9y ago
    True. But its not just the Bay Area. My wife uses LastPass and 2FA and tells others about it at work and she's a mental health counselor, not a software engineer. I guess my influence did have some influence. My parents are also on 2FA. We're in the Atlanta, Georgia, area, not the Bay Area ;-p
- andrewstuart2 9y ago
  I agree the title that it's bad as well. It eventually creates password fatigue and users are less likely to expend mental effort picking good passwords if they know those passwords are going to be thrown away in 90 days. Really the only thing I recommend anymore is a good password managers. Use one very strong password, perhaps changed every 2-3 years if you feel the need, to unlock one or more secure private keys with which all your passwords have been encrypted. The great thing about good password managers that use asymmetric cryptography is that my password is not really the weakest link. If you have access to my hardware, then guessing my password will potentially help you, but otherwise you'll have to break my pgp key (assuming you can also get access to the encrypted password store). At that point I don't really care what your rotation policy is. I can generate a new password every 90 days with no real fatigue.
- LinuxBender 9y ago
  We will just have to disagree. With time, all passwords can be brute forced. If you change them periodically, using a pw manager and/or a strong methodology, then it becomes more expensive to keep brute forcing. History shows us that sites are popped on a regular basis and their users do not always find out right away. Sometimes the org in question doesn't even know for a while.
  - dsacco 9y ago
    > With time, all passwords can be brute forced. If you change them periodically, using a pw manager and/or a strong methodology, then it becomes more expensive to keep brute forcing. That doesn't make sense. If a password already takes longer than the age of the universe to practically brute-force, you're not meaningfully gaining anything by forcing users to change their passwords periodically. On the other hand, you are introducing more opportunities for mistakes to occur in what is already the most dangerous failure point (the human). I left in a reasonable acknowledgement that technology changes can make currently safe passwords weak in the future. That's a good reason to change a password. But periodic password changes don't make sense unless "periodic" refers to timescales longer than anyone here has been alive, because it's inconsequential compared to the cover time provided by a strong password. The argument that passwords should be rotated is mostly a response to users predominantly choosing weak passwords. But if you're in a position to enforce password rotation, you're also in a position to enforce strong passwords. Password rotation is a usability-reducing, incomplete and poor method of enforcing user safety. It is wholly superseded by encouraging people to use password managers, which is a much more optimal and complete solution that does not fatigue the user. Password managers make rotation obsolete, can incorporate password breach monitoring and be made virtually frictionless (they can be incorporated directly in the browser and turned on by default).
    - LinuxBender 9y ago
      > If a password already takes longer than the age of the universe to practically brute-force Give hashcat a go. Give me the hashes from HN. I bet we can break most of them in a day.
ScottBurson 9y ago
> There is no issue with periodically changing passwords in and of itself. I suppose this is true as long as you're not having to record the password in some insecure place (like a sticky note on your monitor) because you can't remember it. In practice, this seems to require either (a) using a password manager or (b) keeping most of the password the same and just changing one or two characters (because learning a completely new random password every 90 days is too hard). In case (a), periodically changing the password is not harmful, but it's also completely pointless; just have your password manager generate a 16-character or longer password, and there's no need to change it, unless you're aware it's been compromised. In case (b), again, periodically changing it is not harmful, but it's also probably pointless. Consider that if an attacker learns your password somehow, and you don't know about it, they're likely to have weeks if not months of unfettered access. Then one day they try to log in as you and can't; seems like the first thing they're likely to do is to try small variations on the password they've been using, whereby they're likely to find your new password. Anyway, I've never heard of a user imposing a password rotation policy on themselves. Have you?
- arcbyte 9y ago
  Not password rotation per se, but i do have a tiered set of passwords, and every now and then change up the most secure password to something new and demote the rest.
sctb 9y ago
Thanks, we've updated the title to clarify.
InclinedPlane 9y ago
That ... seems like an issue with periodically changing passwords. You can't take the human factor out of the equation here, no matter how much you might want to. Passwords exist because of the human factor, otherwise we'd just use 4096-bit keys or something.
Abekkus 9y ago
Specificity beyond the point of courtesy is NIST's mission, and it's passion. Please, nitpick away.

dsacco 9y ago

I disagree. In principle, every time a password is changed is a point of failure - it's additional overhead that has the opportunity to go wrong. If a password does not need to be changed, don't change it. Set it and forget it. If you generate strong passwords, store them securely in a password manager and use different passwords for each account, you shouldn't need to force a password change unless the password is compromised or technology evolves to make it insecure.

chronic940 9y ago
> store them securely in a password manager and use different passwords for each account You are about the 2% of the tech crowd (i.e, bay area software/data people). The vast majority of engineers do not use a password manager, let alone the entire US populace. You severely overestimate the amount the average person cares about password security.
- wayn3 9y ago
  id much rather have a reasonable solution for widespread 2 factor authentication than this password mess. with my bank i have a password, an app on my phone that generates a key and if i perform significant transactions, they call me to confirm before processing it. the idea that i'm going to use a different password for every stupid site out there that i have an account with is a bit silly. if someone desperately wants to compromise some of them then so be it. hijack my twitter if it makes you feel better. im not going to waste mental energy on securing social media. "just use a password manager" sounds cute. password managers are compromised, too. password managers are about as trustworthy as the people who operate them. theres no way im handing my passwords for bank accounts over to some random company and for passwords that protect pointless internet nonsense, im not going to use one either because its irrelevant. you can invoke this whole "password managers are secure" hoohaa. if they ACTUALLY encrypt your passwords properly and ACTUALLY dont save them on their own servers for whatever they want to do with them later, then yes, they probably are secure. but theres no way to be sure that thats the case. Trusting a password manager introduces more uncertainty into your password woes than they will ever make you more secure, if you really think this whole thing through. the other issue with a password manager is that in theory, they work across platforms. that ends rather abruptly when youre not in a browser and need to enter a password into an app on your phone.
  - interfixus 9y ago
    You seem to be operating under the assumption that all password managers are netbased and commercially operated. This is not the case for PasswordSafe, not the case for the various Keepass implementations out there, and not the case for several other, lesser known projects. I am a happy, contended and reasonably safe KeepassX user since many years ago. While I do see the point of two factor auth in certain situations, I sincerely hop and pray it never takes off in a mandatory big way, uncalled for annoyance as it is in most cases. My 36 character passwords usually do the job just fine.
  - GordonS 9y ago
    > if someone desperately wants to compromise some of them then so be it. hijack my twitter if it makes you feel better. im not going to waste mental energy on securing social media. This is a bit short sited; if you use the same password for everything and your Twitter account gets broken into, then every site where you have the same email address is potentially also broken into
  - defined 9y ago
    You don't need to use a web-based password manager. I use the standalone KeePass app across all my devices, and can paste passwords into apps with no browser access required. I believe KeePass is widely regarded by those who know more than me as cryptographically solid. The only pain point is keeping the databases synchronized across all devices, but it's not that difficult.
- dsacco 9y ago
  We're talking about best practices; I didn't make any claim about how many people use password managers. The point remains - if you want to follow password best practices and optimize for user safety, don't enforce arbitrary password changes. You're right about ordinary users - we should provide them with fewer opportunities to shoot themselves in the foot. The lower the frequency they have to focus on generating passwords, the better.
- rietta 9y ago
  True. But its not just the Bay Area. My wife uses LastPass and 2FA and tells others about it at work and she's a mental health counselor, not a software engineer. I guess my influence did have some influence. My parents are also on 2FA. We're in the Atlanta, Georgia, area, not the Bay Area ;-p
andrewstuart2 9y ago
I agree the title that it's bad as well. It eventually creates password fatigue and users are less likely to expend mental effort picking good passwords if they know those passwords are going to be thrown away in 90 days. Really the only thing I recommend anymore is a good password managers. Use one very strong password, perhaps changed every 2-3 years if you feel the need, to unlock one or more secure private keys with which all your passwords have been encrypted. The great thing about good password managers that use asymmetric cryptography is that my password is not really the weakest link. If you have access to my hardware, then guessing my password will potentially help you, but otherwise you'll have to break my pgp key (assuming you can also get access to the encrypted password store). At that point I don't really care what your rotation policy is. I can generate a new password every 90 days with no real fatigue.
LinuxBender 9y ago
We will just have to disagree. With time, all passwords can be brute forced. If you change them periodically, using a pw manager and/or a strong methodology, then it becomes more expensive to keep brute forcing. History shows us that sites are popped on a regular basis and their users do not always find out right away. Sometimes the org in question doesn't even know for a while.
- dsacco 9y ago
  > With time, all passwords can be brute forced. If you change them periodically, using a pw manager and/or a strong methodology, then it becomes more expensive to keep brute forcing. That doesn't make sense. If a password already takes longer than the age of the universe to practically brute-force, you're not meaningfully gaining anything by forcing users to change their passwords periodically. On the other hand, you are introducing more opportunities for mistakes to occur in what is already the most dangerous failure point (the human). I left in a reasonable acknowledgement that technology changes can make currently safe passwords weak in the future. That's a good reason to change a password. But periodic password changes don't make sense unless "periodic" refers to timescales longer than anyone here has been alive, because it's inconsequential compared to the cover time provided by a strong password. The argument that passwords should be rotated is mostly a response to users predominantly choosing weak passwords. But if you're in a position to enforce password rotation, you're also in a position to enforce strong passwords. Password rotation is a usability-reducing, incomplete and poor method of enforcing user safety. It is wholly superseded by encouraging people to use password managers, which is a much more optimal and complete solution that does not fatigue the user. Password managers make rotation obsolete, can incorporate password breach monitoring and be made virtually frictionless (they can be incorporated directly in the browser and turned on by default).
  - LinuxBender 9y ago
    > If a password already takes longer than the age of the universe to practically brute-force Give hashcat a go. Give me the hashes from HN. I bet we can break most of them in a day.

ScottBurson 9y ago

> There is no issue with periodically changing passwords in and of itself. I suppose this is true as long as you're not having to record the password in some insecure place (like a sticky note on your monitor) because you can't remember it. In practice, this seems to require either (a) using a password manager or (b) keeping most of the password the same and just changing one or two characters (because learning a completely new random password every 90 days is too hard). In case (a), periodically changing the password is not harmful, but it's also completely pointless; just have your password manager generate a 16-character or longer password, and there's no need to change it, unless you're aware it's been compromised. In case (b), again, periodically changing it is not harmful, but it's also probably pointless. Consider that if an attacker learns your password somehow, and you don't know about it, they're likely to have weeks if not months of unfettered access. Then one day they try to log in as you and can't; seems like the first thing they're likely to do is to try small variations on the password they've been using, whereby they're likely to find your new password. Anyway, I've never heard of a user imposing a password rotation policy on themselves. Have you?

arcbyte 9y ago
Not password rotation per se, but i do have a tiered set of passwords, and every now and then change up the most secure password to something new and demote the rest.

sctb 9y ago

Thanks, we've updated the title to clarify.

InclinedPlane 9y ago

That ... seems like an issue with periodically changing passwords. You can't take the human factor out of the equation here, no matter how much you might want to. Passwords exist because of the human factor, otherwise we'd just use 4096-bit keys or something.

Abekkus 9y ago

Specificity beyond the point of courtesy is NIST's mission, and it's passion. Please, nitpick away.