3 ms·

What is a bad password? It's a password that's easy to guess. Nobody is going to guess 500 million passwords. If they get the password hash, just assume they're

What is a bad password? It's a password that's easy to guess. Nobody is going to guess 500 million passwords. If they get the password hash, just assume they're going to crack it. To protect against this eventuality, I think forcing users to create a new password every 6 months might be a really powerful protection for consumers. Rather than try to verify if a password is easy to guess, you could offer up strong password suggestions if the user can't create a good one in two tries using basic password heuristics. Most online accounts are not critical to a user's life if they get hacked; the real danger is in reused passwords. If you generate random passwords for the users, there's no way they're going to reuse it. So that might be better for user security than just fighting to try to get a password that's impossible to guess/brute force. So my suggestion is to just generate a super difficult password for the user and tell them to save it in their browser's password manager (make sure your site behaves well with browsers' password save feature), and if they forget it, hit that "e-mail me a password reset link" button. After that, implement non-SMS 2FA.

ggggtez 8y ago
>new password every 6 months This has been tried. It doesn't work. Two factor is the real solution.
- peterwwillis 8y ago
  Two factor only prevents someone logging into your current account; it doesn't prevent someone from reusing your password on a different system. I'm talking about two completely different attacks. One is password reuse, one is not. 2FA does not protect against password reuse, because not every system in the world offers 2FA.
  - ggggtez 8y ago
    2FA "only" prevents someone from logging into my account? What do you mean "only"? That's the whole point!
    - occamrazor 8y ago
      If you use the same password with a service with 2FA and one without, and the service with 2FA gets hacked, the attacker can access the service without 2FA with the stolen password. 2FA is a protection against password reuse only for the sites who use it.
- tomjen3 8y ago
  To be fair, most of the issues resulting from forcing password recycling were that people made password systems, incrementing numbers, using the months of the year, etc. I don't know of any, and I suspect there may not have been any, widely used consumer facing systems running around those lines. I suspect most of the problems can be mitigated in a scenario where the use gets a new password, rather than getting to create a new password. But yeah u2f 2fa is an absolute basic limit for serious services these days (pretty much anything else is subject to phishing).
segmondy 8y ago
Any and every password is BAD.
shados 8y ago
> I think forcing users to create a new password every 6 months might be a really powerful protection for consumers I _almost_ (not quite, but almost) would rather get my investment/bank accounts hacked than this. I use a password manager, and just counting the ones I used in the last couple of months add up to like 150+ passwords. Total, I have hundreds for my active accounts across various sites, services, devices, etc. If I had to change them every 6 months, I'd be doing almost nothing else. Could be mitigated with some API integrations where every 6 months my password manager could just update the password on its own, but that will never be standard across everything.

ggggtez 8y ago

>new password every 6 months This has been tried. It doesn't work. Two factor is the real solution.

peterwwillis 8y ago
Two factor only prevents someone logging into your current account; it doesn't prevent someone from reusing your password on a different system. I'm talking about two completely different attacks. One is password reuse, one is not. 2FA does not protect against password reuse, because not every system in the world offers 2FA.
- ggggtez 8y ago
  2FA "only" prevents someone from logging into my account? What do you mean "only"? That's the whole point!
  - occamrazor 8y ago
    If you use the same password with a service with 2FA and one without, and the service with 2FA gets hacked, the attacker can access the service without 2FA with the stolen password. 2FA is a protection against password reuse only for the sites who use it.
tomjen3 8y ago
To be fair, most of the issues resulting from forcing password recycling were that people made password systems, incrementing numbers, using the months of the year, etc. I don't know of any, and I suspect there may not have been any, widely used consumer facing systems running around those lines. I suspect most of the problems can be mitigated in a scenario where the use gets a new password, rather than getting to create a new password. But yeah u2f 2fa is an absolute basic limit for serious services these days (pretty much anything else is subject to phishing).

segmondy 8y ago

Any and every password is BAD.

shados 8y ago

> I think forcing users to create a new password every 6 months might be a really powerful protection for consumers I _almost_ (not quite, but almost) would rather get my investment/bank accounts hacked than this. I use a password manager, and just counting the ones I used in the last couple of months add up to like 150+ passwords. Total, I have hundreds for my active accounts across various sites, services, devices, etc. If I had to change them every 6 months, I'd be doing almost nothing else. Could be mitigated with some API integrations where every 6 months my password manager could just update the password on its own, but that will never be standard across everything.