4 ms·

I've always wondered how many engineer hours have been lost on the phone with helpdesks sorting out expired passwords.

by davemp 7y ago

dcow 7y ago
I did some lunch table math a few weeks ago. Assuming it takes on average 30 min for an employee to rotate a password (reboots, re-logins, etc.), assuming an average $50/hr across all employees, ~600k employees @ 4 changes per year (my current company policy is ever 80-ish days) = $60MM of human time spent per year making the company less secure.
- Aeolun 7y ago
  It doesn’t take 30 minutes to change my password from ‘password5’ to ‘password6’ though.
  - swish_bob 7y ago
    If I don't restart my laptop after changing my password, I'm saving up for a whole load of shit. The proxy logins may, or may not, continue to work, but it's highly likely that at some point in the next few hours, Outlook is going to trigger 3 failed password checks and lock me out of my mailbox. And that's assuming it expires when I'm in the office, whereas what seems to happen roughly half the time is it expires when I'm connected via the VPN.
  - bjnord 7y ago
    You're assuming it works. Where I work we have an intranet-based web app that pushes the new password to all the various corporate systems. We're forced to choose a new password every 90 days. I'd say 1 time out of 3 something doesn't work, and I have to open a support ticket. While I'm waiting for support, I'm not getting emails, or can't log in to some systems, etc. Multiply that by hundreds of users at my company. Twice, support resolved the issue by resetting my password and telling me the new one... which is my last name plus 4 digits. Then I can live with a very insecure password for 90 days, or try the reset app roulette again.
thrower123 7y ago
It's an insane amount. I've worked on writing helpdesk software for almost a decade now, and from time to time we are asked by our customers to run some analysis on their data; password resets are usually from 25% to 50% of the total requests to the system.
- Consultant32452 7y ago
  I work in the identity management space of a household name financial institution. We have varying levels of outages, but the top priority one is if people are unable to reset passwords through our UI. It's an absolute nightmare.
scarejunba 7y ago
The real problem? People introduce password expiration to improve security, but the means of producing a new unexpired password after being locked out is less secure than the password itself creating a net loss in security.
- noobermin 7y ago
  How did this idea of expiring passwords arise in the first place? Misguided intuition or did the infosec people back then just get it wrong?
  - extra88 7y ago
    I don't know the origin story but (U.S.) National Institute of Standards and Technology (NIST) recommending password expirations from 2003 until 2016 played a part in propagating them. But I think that recommendation was largely based on was already fairly common, I think Microsoft Windows and Active Directory accounts expired by default well before 2003 (at least Windows NT and its successors).
  - dredmorbius 7y ago
    It's existed in some form since at least the 1990s, likely through institutional or government practice. A (possible) example from a 1997 Sybase manual: https://books.google.com/books?id=GzGuPO5fKOEC&q="password+expiration"&dq="password+expiration"&hl=en&sa=X&ved=0ahUKEwjv7sHz_sviAhVCKa0KHUpPC7Y4ChDoAQgMMAA https://books.google.com/books?id=GzGuPO5fKOEC&q="password+e... I just checked Simpson & Garfinkel's PUIS, which does mention forced changes, but not scheduled expiry. Also 1997. (Google Book Search is badly polluted by mis-dated publications: http://www.google.com/search?q="password+expiration"&lr=lang_en&tbs=lr:lang_1en&tbm=bks&ei=FmH0XO-LGsLStAXKnq2wCw&start=20&sa=N http://www.google.com/search?q="password+expiration"&lr=lang... ) Ngram plot: https://books.google.com/ngrams/graph?content=password+expiration&year_start=1980&year_end=2000&corpus=15&smoothing=3&share=&direct_url=t1%3B%2Cpassword%20expiration%3B%2Cc0 https://books.google.com/ngrams/graph?content=password+expir...
    - ScottBurson 7y ago
rconti 7y ago
My favorite one was when I supported a customer who expired our passwords every 60 days, and resetting it involved calling Sweden (from the US) between roughly 10:30pm and 7am Pacific. Needless to say, of the 40 or so people who should have been doing this, few of them were. And that was just one of a dozen or two customers with varied policies requiring we turn over SSNs, carry SecurID tokens, install various soft tokens on our laptops, roll passwords every so often, go through various and sundry jump hosts, etc......

I've always wondered how many engineer hours have been lost on the phone with helpdesks sorting out expired passwords.

by davemp 7y ago

I've always wondered how many engineer hours have been lost on the phone with helpdesks sorting out expired passwords.

dcow 7y ago

I did some lunch table math a few weeks ago. Assuming it takes on average 30 min for an employee to rotate a password (reboots, re-logins, etc.), assuming an average $50/hr across all employees, ~600k employees @ 4 changes per year (my current company policy is ever 80-ish days) = $60MM of human time spent per year making the company less secure.

Aeolun 7y ago
It doesn’t take 30 minutes to change my password from ‘password5’ to ‘password6’ though.
- swish_bob 7y ago
  If I don't restart my laptop after changing my password, I'm saving up for a whole load of shit. The proxy logins may, or may not, continue to work, but it's highly likely that at some point in the next few hours, Outlook is going to trigger 3 failed password checks and lock me out of my mailbox. And that's assuming it expires when I'm in the office, whereas what seems to happen roughly half the time is it expires when I'm connected via the VPN.
- bjnord 7y ago
  You're assuming it works. Where I work we have an intranet-based web app that pushes the new password to all the various corporate systems. We're forced to choose a new password every 90 days. I'd say 1 time out of 3 something doesn't work, and I have to open a support ticket. While I'm waiting for support, I'm not getting emails, or can't log in to some systems, etc. Multiply that by hundreds of users at my company. Twice, support resolved the issue by resetting my password and telling me the new one... which is my last name plus 4 digits. Then I can live with a very insecure password for 90 days, or try the reset app roulette again.

thrower123 7y ago

It's an insane amount. I've worked on writing helpdesk software for almost a decade now, and from time to time we are asked by our customers to run some analysis on their data; password resets are usually from 25% to 50% of the total requests to the system.

Consultant32452 7y ago
I work in the identity management space of a household name financial institution. We have varying levels of outages, but the top priority one is if people are unable to reset passwords through our UI. It's an absolute nightmare.

scarejunba 7y ago

The real problem? People introduce password expiration to improve security, but the means of producing a new unexpired password after being locked out is less secure than the password itself creating a net loss in security.

noobermin 7y ago
How did this idea of expiring passwords arise in the first place? Misguided intuition or did the infosec people back then just get it wrong?
- extra88 7y ago
  I don't know the origin story but (U.S.) National Institute of Standards and Technology (NIST) recommending password expirations from 2003 until 2016 played a part in propagating them. But I think that recommendation was largely based on was already fairly common, I think Microsoft Windows and Active Directory accounts expired by default well before 2003 (at least Windows NT and its successors).
- dredmorbius 7y ago
  It's existed in some form since at least the 1990s, likely through institutional or government practice. A (possible) example from a 1997 Sybase manual: https://books.google.com/books?id=GzGuPO5fKOEC&q="password+expiration"&dq="password+expiration"&hl=en&sa=X&ved=0ahUKEwjv7sHz_sviAhVCKa0KHUpPC7Y4ChDoAQgMMAA https://books.google.com/books?id=GzGuPO5fKOEC&q="password+e... I just checked Simpson & Garfinkel's PUIS, which does mention forced changes, but not scheduled expiry. Also 1997. (Google Book Search is badly polluted by mis-dated publications: http://www.google.com/search?q="password+expiration"&lr=lang_en&tbs=lr:lang_1en&tbm=bks&ei=FmH0XO-LGsLStAXKnq2wCw&start=20&sa=N http://www.google.com/search?q="password+expiration"&lr=lang... ) Ngram plot: https://books.google.com/ngrams/graph?content=password+expiration&year_start=1980&year_end=2000&corpus=15&smoothing=3&share=&direct_url=t1%3B%2Cpassword%20expiration%3B%2Cc0 https://books.google.com/ngrams/graph?content=password+expir...
  - ScottBurson 7y ago

rconti 7y ago

My favorite one was when I supported a customer who expired our passwords every 60 days, and resetting it involved calling Sweden (from the US) between roughly 10:30pm and 7am Pacific. Needless to say, of the 40 or so people who should have been doing this, few of them were. And that was just one of a dozen or two customers with varied policies requiring we turn over SSNs, carry SecurID tokens, install various soft tokens on our laptops, roll passwords every so often, go through various and sundry jump hosts, etc......