9 ms·
The article kinda misses the reason why mandatory password changes existed in the first place -- unknown breaches. The idea was that if there was an undetected
by qw3rty01 6y ago
The article kinda misses the reason why mandatory password changes existed in the first place -- unknown breaches. The idea was that if there was an undetected breach, the attacker would have a maximum of the mandatory password change to use credentials. You would still have mandatory password changes upon discovering a breach, which would reset the counter. And the article wasn't very clear as to why this is no longer recommended, but when mandatory password changes are enforced, users tend to make new passwords which are trivial to crack if you have a known old password. So if there's an unknown (or even known) breach, users will tend to make a new password which an attacker can easily guess given the older known passwords, losing any benefit gained from mandatory password changes. And this is worse than not having mandatory password changes, because rare password changes (when a breach is discovered) don't put people into the habit of just iterating off of an old password.
- ocdtrekkie 6y agoYeah, I think there's value in it, but if you don't have a way to prevent "plus one passwords", it probably isn't super effective anyways. It may be a case where frustrating the user four times a year isn't worth it... maybe just frustrating them once a year will lead people to put more effort into making their passwords suitably different.
- qw3rty01 6y agoThere definitely is value in it if users created proper passwords, but path of least resistance tends to win out in the end, and people will just find ways around the mechanisms to prevent weaker derived passwords.
- csours 6y ago"A friend" used to have the password set to the 3 character month name + the month ordinal + "!" - MarMar04! We were required to change passwords once a month, and not re-use any of our last 6 passwords.
- letitbeirie 6y agoMy "friend" doesn't use this system anymore, but passwords along the line of '1stQuarter2001!' worked for well over a decade of being required to change passwords 4 times a year.
- rightbyte 6y agoNice! My friend rotate through 3 digits to be able to guess it quicker when he forgets which digit it is. This solves it.
- baobabKoodaa 6y agoAm I the only one bothered by month ordinal 04 assigned to March, which is the 3rd month? This sounds almost like Java's infamous Date class that assigned month ordinal 2 for March, except somehow we've managed to make the off-by-one error in the other direction :D
- GordonS 6y agoFour times a year? I've had to change mine once a month for the past 20 years. Needless to say, I increment a numeric suffix that wraps around every 10 or so months. It has always seemed like a totally pointless exercise. I can see potential value for service accounts, as long as you have automation in place to change them where needed - but for user accounts, it's complete madness.
- marcosdumay 6y agoHum... I have never seen any place that implemented password rotation for the users and didn't exempt service accounts. And the security solution sellers I've talked to are all either on the position of "yeah, password rotation is incredibly important, but you can't rotate service accounts" or "yeah, I know you don't rotate the password of service accounts (no need to tell me), here's a tool to reduce the risk this causes".
- ocdtrekkie 6y agoMicrosoft's approach now is to recommend using Managed Service Accounts, which is an Active Directory feature in modern Windows servers. They rotate their own passwords through some sort of magic. That being said, plenty of janky old Windows apps won't work with them anyways.
- GordonS 6y agoPlace I work started rotating service account passwords around a year ago, using automation built in to some super expensive PIM (Privileged Identity Management) system.
- marcosdumay 6y agoJust to complement, so next time I can say I heard about one place on the internet... Does your workplace require password rotation for personal users?
- GordonS 6y ago
- RcouF1uZ4gsC 6y agoIt sounds good in theory, but in practice rotating passwords really doesn't help much. You alluded to it in your last sentence, but if you require password rotations, say every year, a lot of your users will end up using: basepassword-2021 which they will change next year to basepassword-2022 Because password hashing makes it impossible to retrieve the original password, there is no way to guard against people just using a basepassword and appending some type of counter to it. Thus if there really is a breach where the plaintext password is recovered by an attacker it is trivial to find out what this year's version is. So all you end up doing is needlessly irritating your users, for not much security. Multifactor Authentication is a much better solution for the issues of unknown breaches.
- zrail 6y ago> there is no way to guard against people just using a basepassword and appending some type of counter to it. Sure there is. In your update logic, decrement any numbers and check the hash against the existing password. Alternatively, require the existing password in the same form and you don't have to check against hashes, since you have the plaintext password right there.
- glasss 6y agoI don't believe there is any function to perform these checks in Windows Active Directory or Office 365.
- avianlyric 6y agoI think you underestimate people inventiveness when it comes to circumventing these types of systems. People will either keep trying new strategies to embed counters in their passwords (maybe increment a letter, or multiple a number by 10), or they’ll just write the password on a post-it they keep on their laptop. Either way you’ve now got a whole load of complicated code that makes it harder to people to create genuinely strong and memorable passwords, and no additional security.
- josephcsible 6y agoThis wouldn't work either. It would just make users bounce between 2 passwords: foo100 -> bar200 -> foo101 -> bar201 -> foo102, etc.
- cratermoon 6y agoYou'd have to make users change their password every day to fend off undetected breaches now.
- tinus_hn 6y agoIf your security is breached every day passwords, whether you change them daily or not, are not going to save you.
- cratermoon 6y agoIt's not about one company being breached any more. It's about the entire world of password databases, rainbow tables, easy and fast cracking tools.
- tinus_hn 6y agoWhy would that require changing passwords every day? You can’t use these tools without compromising the site first.
- cratermoon 6y agoOne of original motivations for password expiration was the belief that if your password DB was stolen, you had some significant amount of time before any malicious party would be able to crack a password and use it. That is no longer true: it's extremely likely that at least one user in your system has a password that is trivially cracked or in a rainbow table. Your system is vulnerable in a day, or less, after you've had your passwords stolen.
- tinus_hn 6y agoRainbow tables are essentially instantaneous so one day isn’t enough either. If you care about that kind of scenario I’d say your energy is better spent on just picking a more suitable hash algorithm.
- tape_measure 6y agoWould it be a bad idea to salt and hash probable increments of a password when it is changed? For example, password would be salted, hashed, and stored along with Password, password1, etc. Then the system could reject these on the next password change without storage of the original plaintext password.
- tape_measure 6y agoixwt gave a better solution - do these calculations when the password is changed, not when it is set. Therefore, less storage is required
- TheDudeMan 6y agoIt does not seem that difficult to detect when the new password is very similar to the old password. Do it on the client side on a page that the user enters both the old and the new. And give the user guidance to use a password manager and auto-generated password.
- II2II 6y agoIf I recall correctly: Active Directory can be setup so that the last few passwords cannot be reused, otherwise people would just cycle through two passwords. I am guessing that people would simply use a variation of their second to last password to come up with a new password under your proposal.
- bentcorner 6y agoA long time ago as a student I worked at a company that had mandatory password changes every month. So I just used the same password and appended the current month to it.
- Spooky23 6y agoThe control for that is to not permit password changes for a period of time.
- gmfawcett 6y agoIf the old password is salted and hashed (which it should be), then it is practically impossible to detect when the new password is similar.
- muttled 6y agoA better focus for security efforts is detection of compromise. For example, say you detect a user has signed in from 2 different countries in a short window or perhaps malware signs are discovered in their cloud storage. Perhaps MFA is failing often for a user meaning an attacker is successfully using a password but is unable to get past confirmation on the user's phone.
- jaywalk 6y agoThis is the key. With Okta for example, you can configure a maximum velocity for a user for Behavior Detection to trigger additional scrutiny on a login. That type of stuff is useful.
- rtkwe 6y agoHow well does this handle things like logging in from mobile devices? If I logged in from my desktop and later from my mobile phone I would appear to zip 350 miles because my mobile data exits the phone network 2 states and 350 miles away.
- moron4hire 6y agoI don't understand what you mean. The cellular network to which you are connected is not forwarding your requests to your "home" cellular network.
- anonymfus 6y agoI thought that now every cellular provider actually does this so when you move between networks your IP address stays the same as otherwise all your connections would break during handover; and not breaking connections is basically mandatory since voice over LTE, because voice calls now run over IP protocol too and seamless handover for voice is expected by users.
- vel0city 6y ago
- naikrovek 6y agodo attackers wait to use passwords months after they've compromised those passwords? or, do they give themselves other ways to maintain their access so that no passwords stand in their way from that point on? it's the latter, not the former. once you're compromised, passwords, changed or not, are no longer an obstacle at all. password rotation does not increase security.
- crazygringo 6y agoReally depends on the level of access the password gives you. If you're infiltrating a company, most people's accounts certainly don't give you the level of access required to bypass the need for passwords entirely. You'd have to be specifically hacking a sysadmin's account or something. There are very many different levels of "compromised" and they're not all the same. That being said, I agree with the overall premise that password rotation is outdated.
- grepthisab 6y agoHi, attacker here, I usually use the password immediately but it really depends on the level of user as to whether I can ensure that password changes won't affect me going forward. If you're a normal user, changing the password is helpful. Root? Forget about it.
- numpad0 6y ago> do attackers wait to use passwords months Unix-like OS in 80s-90s truncated passwords to 8 bytes, hashed in MD5 and stored them to regular file `/etc/passwd`. And in those era it was estimated to take six months to few centuries to brute force a password, therefore it was recommended to maximally complicate the password within 8 letters in length, and change it every one half the brute forcing time, or three months. Supposedly everything made sense in that timeframe in that context.
- cesarb 6y ago> Unix-like OS in 80s-90s truncated passwords to 8 bytes, hashed in MD5 and stored them to regular file `/etc/passwd`. In the era when password hashes were still readable to everyone in /etc/passwd (this was later fixed by storing the passwords instead in a shadow file called /etc/shadow which can only be read by root), it was not MD5, but "crypt" (a DES variant). AFAIK, the MD5 and newer password hashing schemes don't truncate the password to 8 bytes, only traditional "crypt" did that.
- andi999 6y agoActually the fastest possible way to detect unknows breaches on the user side is to show your last login time. (On the server side is looking for IP patterns)
- slaymaker1907 6y agoI think approximate location would be a good idea too. I wouldn't remember the last time I logged in to many important services since I do it so often. Relatedly, I have trouble remembering when I paid for so something so just looking at my banking log for fraud requires me to see who the payment actually goes out to.
- millerm 6y agoUnfortunately, a lot of us are using VPNs now. So, location isn't a very good indicator as that would provide a lot of false positives. That actually happened to me recently, and I though "Oh yeah, I was using a VPN then." So, that indicator is just getting worse as I use a VPN on my phone all the time now.
- deleted 6y ago[deleted]
- crazygringo 6y agoIn theory, but in practice some accounts are only rarely accessed by their intended user (might not log in for months at a time). And on the flip side, it's really easy to ignore the displayed last log-in time/IP/location altogether.
- charcircuit 6y agoAttackers can easily mitigate this by using residential proxies.
- UnquietTinkerer 6y agoOff topic for password rotation, but has anyone tried assigning randomly generated passwords to the users rather than letting them choose their own? People (including me) _hate_ memorizing things and would probably write an assigned password down, but isn't it better to expose passwords to nosy coworkers than to the whole internet, as is so often the case with weak or reused passwords?
- wolverine876 6y agoThat's been our practice, for the reasons you describe, and we also take steps to make the passwords memorable (while retaining sufficient resistance to cracking). We also tell users that if they write down the password, don't write 'password' or the username or anything else on the paper - you will know what it is - and don't put it someplace obvious (on the monitor, under the keyboard, etc.).
- benhurmarcel 6y agoBest way to have all passwords written on post-its under each monitor.
- jodrellblank 6y agoYou have access to the office where the monitor is, you have the post-it note. Somewhere you are, something you have; 2FA right there.
- teddyh 6y ago> has anyone tried assigning randomly generated passwords to the users We do that. We generate long random-character passwords (both for e-mail, web sites, and other accounts), and we don’t provide any online way for users to change them. If the users need to change a password, they have to contact us to do it (which is reasonable, since a big part of our value proposition is our responsive support). We only very occasionally even get such requests, and even more seldom get requests from users to set their own passwords. So far, everybody has been perfectly satisfied when hearing “No, users don’t set their own passwords. We can generate a new one for you any time you like.”. This policy has been in effect since before my time, and I have worked here for more than 10 years. During this time, there was one user who really wanted something more memorizable for a specific account, so I set a correcthorsebatterystaple-style password on that account only. One other user had trouble adding the password to their password manager, and I had to help them do that. Otherwise, no problems.
- tamrix 6y agoJust going to say, if you've been beached, you've pretty much done for anyway. The focus should be on preventing a security breach, not what to do after its happened.
- baobabKoodaa 6y agoYou need to focus on both preventing breaches and reacting to them. Sadly, this password expiration policy does not help with either.