33 ms·
This should not be a surprise, as this supports the NIST's revised recommendations (from June 2017!) that passwords should not expire [0], because it actually l
by hwbehrens 7y ago
This should not be a surprise, as this supports the NIST's revised recommendations (from June 2017!) that passwords should not expire [0], because it actually leads to less-secure passwords for this exact reason.
Furthermore, many corporate systems do not integrate well with password managers, such as when first logging in to your system in the morning. This means that the password is likely to be one of the few that must actually be memorized.
If you ask me to memorize a 32-character random string, I will, but I won't memorize a different 32-character string every 6 months!
[0]: https://pages.nist.gov/800-63-FAQ/#q-b05 https://pages.nist.gov/800-63-FAQ/#q-b05
- ouid 7y agoplease memorize: ZBkhTG1mchw7tr5bdKqknGGqFifuGDi7
- hwbehrens 7y agoSorry, I've already been asked to memorize a 32-character string, so the slot has been filled. Coincidentally, it also starts with Z.
- FrozenTuna 7y agoJoke's on you! You just cut my brute force attack time in half! Only 1 billion years left!
- IIAOPSW 7y agoWait, was that capital Z or lowercase z?
- bb88 7y agoIt's not just memorizing it, it's typing it every single time for every transaction that you want to do, if the administrators require it. The recommendation on one system I use is to force ssh and auth with username/pw for every git transaction. Because Security!
- blotter_paper 7y agoIf I had a good reason to memorize this, I would have it down within a couple weeks. I'm pretty certain of this, as I do have private keys committed to memory. That's not even impressive, folks who have good memory palace practices could recite that string for you a few minutes after seeing it. I wouldn't expect it of the average user, but it is totally doable for a human of average intelligence -- it's just not something people care about. For long term storage (rather than a repeatedly entered password) it's even easier if you convert[0] it to an equally random yet more humanly memorable line of text: "duck fade ink love reality possible shown screw thing win invisible realize child suffocate somehow petal army nervous" [0]: https://brainwalletx.github.io/#converter https://brainwalletx.github.io/#converter
- jerf 7y agoZaphod Beeblebrox's kite harasses Tuscon. Great, one more collapsing home. Why? 7 termites risk 5 bad days. Knight's queen kills narcs; Good Game queen. Fighting inside futons upends Greater Detroit in 7. But that's because you forced the choice on me, and I'm only willing to work so hard for a Hacker News post. Ideally, you turn it into one coherent story. If I can choose my password, and I usually can after all: Zaphod Beeblebrox wears 3 hats. He gives 1 to Ford. Why did he do that? He only has 2 heads. Xavier can't read Zaphod's mind now. (Does he even want to?) ZBw3hHg1tFWdhdt?Hoh2hXcrZmn(Dhewt?) That's 35. I could have that mostly memorized in a day's relatively normal usage, and definitely have it by a week. I have some rules I apply, like numbers -> their digits, periods are "free" but the other punctuation goes in, etc. Doesn't much matter what your rules are, as long as you're consistent. Technically, this is less random that a truly random password, because rather than drawing uniformly from the space of possible symbols, you're tilted in the direction of what words can start with and some other things like that. I tend to just make up for that by swinging more entropy at the problem, and trying to work in some Xs and Zs and unusual symbols, and figure that it gets me close enough. One trick to this: If you find in the first day that you're consistently remembering the phrase differently than you first laid it out, just take the hint and change the password.
- Insanity 7y agoHow fast can you enter that password? Like, is it a reasonable time or are you basically pecking at your keys?
- nwallin 7y agoI do passwords this way. At first, it's pretty slow, but after a while it's muscle memory: my fingers know my passwords better than my brain does. I don't do passwords this way at work anymore, because they make us change it every 90 days. I just use keyboard patterns, and shift the pattern to the right for each successive password. Seriously people, expiring passwords is an idiotic idea.
- jerf 7y agoI don't actually use 35-char passwords. That was just to answer the challenge. Mine are more on the order of 20. It's fairly fast, actually. One of the things I've decided to do is trade some entropy for having only lower case letters and the minimum symbol count, because what tended to screw me up most was synchronizing the shift key with the rest of the password... which I suppose also gives a clue about the speed. It's at least no slower than a passphrase of equivalent strength, and it fits my brain. But if passphrases work better for you, by all means, please do. Also, I have a password manager. I only have about 4 of these at any given time, and I can afford the cognitive burden of ensuring they are all very strong. It'd be a different problem otherwise.
- AllegedAlec 7y ago> writes it down in his phone, protected by a 4 digit pin code
- smacktoward 7y agoIn fairness, if you have a good password manager on that phone, that password will be protected by not just the device's unlock PIN but the password vault's master password as well, along with potentially other layers of added protection as well (a second factor to unlock the password vault, biometric authentication to unlock the vault or the device, etc.) But almost nobody uses a good password manager, so... yeah.
- discreditable 7y agoMy argument for password expiry (300 days here) is my users have complained they can't keep using the password they use everywhere else.
- Wowfunhappy 7y agoAnd yet, you're also making it impractical for them to actually use a unique password, see what the GP said.
- discreditable 7y agoNothing stops them from using a unique passphrase. I am subjected to the same password requirements and use a unique passphrase every time. I see harvested passwords as a larger threat than bruteforcing, so some kind of expiry is important. Some users might use good, unique passwords, but most will not.
- criddell 7y agoAre you saying NIST and Schneier are wrong about this?
- discreditable 7y agoSchneier says "don't make people change their passwords unless there's indication of compromise" I make the assumption that the longer a password exists, the more likely it's reused and compromised. I don't have insight into every password dump, but I know my users reuse passwords a lot. I think a long expiry is the best balance in my environment.
- acdha 7y agoThat’s not an indication of compromise: just you increasing the odds of people creating predictable passwords. If you’re concerned about dumps, setup one of the services which checks against HIBP for known-leaked passwords and then put all of your effort into MFA (especially FIDO) because that will stop the kind of attacks which are common in this century: immediate use of compromised credentials, high-skill phishing, etc.
- orand 7y agoBruce Schneier's summarization [0] of NIST's revised recommendations: 1. Stop it with the annoying password complexity rules. They make passwords harder to remember. They increase errors because artificially complex passwords are harder to type in. And they don't help that much. It's better to allow people to use pass phrases. 2. Stop it with password expiration. That was an old idea for an old way we used computers. Today, don't make people change their passwords unless there's indication of compromise. 3. Let people use password managers. This is how we deal with all the passwords we need. [0]: https://www.schneier.com/blog/archives/2017/10/changes_in_pass.html https://www.schneier.com/blog/archives/2017/10/changes_in_pa...
- trianglem 7y agoI agree with all of this except password managers. If you use a lot of different public computers or temporary work laptops they don’t always let you install LastPass, so I frequently ended up being unable to access my accounts.
- nickthegreek 7y agoI access my manager from my phone and type them in. I would never install my LastPass on a public computer even if they let me.
- Sohcahtoa82 7y agoAnd then you've got your phone open, displaying your password to shoulder surfers, for as long as it takes to type in your password.
- cbm-vic-20 7y agoI have a hard enough time typing 4mfkD.Q.27cC8,'@eG}a4{\* , I am very much not worried about a "shoulder surfer" either seeing the cleartext password on my tiny phone screen, or watching all of those keystrokes without me noticing them.
- dyingkneepad 7y agoI am forced to type 2 to 3 passwords every morning. The IT rules says I can't leave my laptop in my table overnight, so I have to every day type at least the disk encryption password + my login password. And sometimes I also have to type the VPN password. That's already 2 to 3 passwords every single time. Not counting the SSH key passphrases for a lot of stuff...
- tartoran 7y agoAre complicated passwords take you a long time to write? Based on this calculation here's how long we waste on meaningless tasks every year: minutes minutes/month minutes/year(hours/year) 1 ~22 ~266(~4.4h) 2 ~44 ~530(~8.8h) 3 ~66 ~792(~13h) *this only takes into account business work days. If you add weekends the number goes up...
- dyingkneepad 7y agoThis is not only about time wasted. It's about my feelings. It is about the mental effort to memorize them, update them every 90 days (by incrementing the last digit, of course) the frustration of having to type them, and the fact that maybe this is not really the best solution to the problem, yet we're still using it in 2020. I could keep increasing this list forever. Having a strictly technical view over problems always limits what you can see.
- downerending 7y agoI've worked for two trading firms. One required six passwords to reach "root" access, when coming in remotely (e.g., from home). The other used the name of the company as the root password for all hosts, accessible from anywhere within the offices. Horses for courses, I guess.
- lostmsu 7y agoI wish they would read that recommendation at sbir.gov
- Wowfunhappy 7y ago> Furthermore, many corporate systems do not integrate well with password managers, such as when first logging in to your system in the morning. ...are there any desktop OS's which do integrate well with password managers, for your login password? By definition, you can't open the password manager until you've logged into the machine. So you'd need to open the password manager on a separate device. The one exception I can think of is if you're using the password manager built into the system, like Apple's keychain, in which case your login password is basically also your master password. Unfortunately, you then lose the ability to access your passwords on any other company's platform...
- sjy 7y agoI think it's possible to use your FDE key to decrypt the filesystem, autologin to the desktop, unlock GNOME Keyring or a similar keychain application, and use that as a GPG and SSH agent to further encrypt your passwords using pass [1]. Since it's just Git and PGP, there are pass implementations for most OSes. I'm not sure if that counts as "integrating well;" it certainly doesn't work out of the box. I'm using all these components individually, but still typing my password 100 times a day for now. [1]: https://www.passwordstore.org/ https://www.passwordstore.org/
- resfirestar 7y agoPeople should remember that the recommendations are part of a large security program and assume the implementation of others that are not so straightforward. Multi-factor auth and resistance to offline attacks on a stolen database or MITM'd creds in an outdated Windows environment tend to be big technical pain points. Most companies, especially outside of tech, aren't in a position to remove password expiration yet.
- Ajedi32 7y ago> corporate systems do not integrate well with password managers, such as when first logging in to your system in the morning Depends on the password manager. I use Keepass on my phone with the InputStick[0] plugin, for example, and that works great for Windows logins. Even have a macro set up so I can sign in to Windows with one tap. [0]: http://www.inputstick.com/ http://www.inputstick.com/
- octorian 7y ago> such as when first logging in to your system in the morning This is what the article is talking about, but completely misses in its involved complaints. The best password manager in the world will NOT help you actually login to the computer you're running it on. So everyone at work basically has to have at least two passwords that need to be memorized: The main password to login to the machine, and the unlock password for the password manager. Forcing these passwords to be impossible to remember is going to be a huge impediment, given how often you end up actually having to type them.
- crankylinuxuser 7y agoSo I was going to ask a variant on that question... How many businesses do you know follow NIST's new password guidelines?
- bashinator 7y agoMicrosoft, for one. https://practical365.com/security/microsoft-recommending-non-expiring-passwords-to-office-365-customers/ https://practical365.com/security/microsoft-recommending-non...
- tatersolid 7y agoMy dayjob in the banking industry is strictly NIST SP 800-63B compliant for all systems we control. Our industry partners, who are mostly large banks, have idiotic make-work policies. Some are just plain made up without justification by an internal auditor who thinks they’re smart. More than one even consider usernames to be secrets and one threatened to bail on a contract when our apps began displaying the username on-screen and in audit reports.
- ZainRiz 7y agoFrankly, the most surprising thing about this article is that only 49% of people do this. Do the other 51% sincerely try to change their passwords? Or maybe they were too scared to report the truth :P
- clort 7y agoI would guess a lot of them cycle through a short list of easy-to-remember passwords instead. It might be interesting to see how many actually try to sincerely pick that new, secure, password.
- kazinator 7y agoIf you ask me to memorize a 32-character random string every 6 months, I will memorize a 31-character string, plus one incrementing character.
- ProZsolt 7y agoThe funny thing when they don't allow you to do that. They throw an error something like "Your password is too similar to the previous password". Then I know they store it in plain text.
- rightbyte 7y agoThey usually make you write you current password. If they complain about your previous password though ... which is quite common.
- kazinator 7y agoDo we know that? We actually do not. If I have some previous passwords of yours in hashed form, and you give me a new password, what I can do is try to crack your previous passwords by generating nearby passwords based on the new one. For instance, if you give me something that ends in a digit, I can substitute the other nine digits into that and try all those passwords against your prior hashes.
- loeg 7y agoYou could imagine a scheme where they just store N salted hashes of your N-character previous password with 1 character deleted. Then at password changes, they do the same iteration with the candidate password and see if any digests match. This tells them if you made a 1 character change to your password, without storing your old password in plaintext.
- boring_twenties 7y agoYeah... they could be doing that. But these are the same people that implemented the forced password change in the first place. The overwhelming likelihood is that they're storing them in plain text, and the jury might still be out on whether that plain text is world-readable or not.
- hello_tyler 7y agoJust FYI, you have excellent memory. Most users can't remember their 6-8 character alphanumeric.....
- fg6hr 7y agoI think anyone can memorize 32 character passwords every 6 months if one uses some scheme. I usually use long phrases from books: a phrase that means something to me is easy to remember and even if I forget it, it's easy to look it up. Such passwords can be arbitrarily long.
- SlowRobotAhead 7y agoWhen this came out I wasn’t directing IT... I had to (fucking) fight tooth and nail to get our MSP and CFO to accept it. CFO no longer has anything to do with IT, MSP was fired... not for this, for leaving admin credentials in JSON file accessible to everyone on a shared drive. Ah, good times!
- joyjoyjoy 7y ago"This should not be a surprise, as this supports the NIST's revised recommendations (from June 2017!) that passwords should not expire [0], because it actually leads to less-secure passwords for this exact reason." THIS. 10 Times This. Would somebody be so kind to tell this to the eRA Commons website maintainer of the NIH? And when you are one it, please tell eBay I don't want to change my PW if they think someone else tried to log into my account based on their shitty Tracking metrics. I mostly switched from Amazon to eBay but the constant PW change request really annoy me. I have one plain vanilla browser with no anti track plug-ins only for eBay. I once send them a message, that I consider their security guy an idiot, told them to forward him my cell phone number and ask him to give me a call to discuss this PW policy. He never called. :-)
- joyjoyjoy 7y agoAnd since we are on it, if I had a wish I would wish a nerd password option for one time passwords based on regular expressions.
- 010001001010 7y agoAgree. I toyed around with the idea of a password risk score. Password reuse across accounts (with known breach) = 100% Password reuse across account = 90% Unique external password = 30% Unique internal password = 20% Divided by password complexity... or something similar. In this way user is encouraged to maintain good passwords by not being penalised (changing every few months, etc). Of course, this would require something between service and user, such as a password manager.