4 ms·

What is the consensus on not allowing previously used passwords? i.e., when changing your password: "You used this password too recently, you can not use your

by iooi 9y ago

What is the consensus on not allowing previously used passwords? i.e., when changing your password: "You used this password too recently, you can not use your last 20 passwords"

smichel17 9y ago
I am not a security expert; I'm sharing my experience, not attempting to answer the question. Back before I used a good password manager setup, I used a mental algorithm of [base password] + per-site modifications. These were saved in Firefox and I'd sometimes forget them when I wasn't on my normal device. If I needed to get on to a service (eg, email) whose password I'd forgotten, I'd reset it, then reset again, back to what it was, when I got back to a place it was saved. At some point, gmail prohibited this, and I had to update all my passwords whenever I needed to reset. The result was the same as forced password rotation: I just started using more memorable (less secure) passwords. That said, there's definitely measures Google could take to mitigate this effect. For example, drawing from the article, there could be tiered access control, where one tier (eg, 2fa but no pw) lets me get some limited access without changing the password. Then there would be no legitimate reason for returning to an old password, so such a policy is not harmful.
technion 9y ago
The policy of not allowing previous passwords exists in the first place to ensure password rotations really happen. I've been in organisations where you tell people that passwords change every thirty days, and they say "that's ok, I'll just change it and then change it back". Why do I need to change passwords every thirty days? Because it's one of only three questions our risk assessment auditors actually ask, and "failing" is bad news. If we accept we don't need to rotate passwords arbitrarily, there's no reason to have rules like this - it's more secure and less effort to not retain the last 20 passwords.

by iooi 9y ago

What is the consensus on not allowing previously used passwords? i.e., when changing your password: "You used this password too recently, you can not use your last 20 passwords"

smichel17 9y ago

I am not a security expert; I'm sharing my experience, not attempting to answer the question. Back before I used a good password manager setup, I used a mental algorithm of [base password] + per-site modifications. These were saved in Firefox and I'd sometimes forget them when I wasn't on my normal device. If I needed to get on to a service (eg, email) whose password I'd forgotten, I'd reset it, then reset again, back to what it was, when I got back to a place it was saved. At some point, gmail prohibited this, and I had to update all my passwords whenever I needed to reset. The result was the same as forced password rotation: I just started using more memorable (less secure) passwords. That said, there's definitely measures Google could take to mitigate this effect. For example, drawing from the article, there could be tiered access control, where one tier (eg, 2fa but no pw) lets me get some limited access without changing the password. Then there would be no legitimate reason for returning to an old password, so such a policy is not harmful.

technion 9y ago

The policy of not allowing previous passwords exists in the first place to ensure password rotations really happen. I've been in organisations where you tell people that passwords change every thirty days, and they say "that's ok, I'll just change it and then change it back". Why do I need to change passwords every thirty days? Because it's one of only three questions our risk assessment auditors actually ask, and "failing" is bad news. If we accept we don't need to rotate passwords arbitrarily, there's no reason to have rules like this - it's more secure and less effort to not retain the last 20 passwords.