29 ms·
I believe this has been Microsoft's guidance as far back as 2016, with the caveat of using Azure AD risk analysis /MFA.[1] >Password expiration policies do mor
by kipchak 6y ago
I believe this has been Microsoft's guidance as far back as 2016, with the caveat of using Azure AD risk analysis /MFA.[1]
>Password expiration policies do more harm than good, because these policies drive users to very
predictable passwords composed of sequential words and numbers which are closely related to each
other (that is, the next password can be predicted based on the previous password). Password change
offers no containment benefits cyber criminals almost always use credentials as soon as they
compromise them.
>Mandated password changes are a long-standing security practice, but current research strongly
indicates that password expiration has a negative effect. Experiments have shown that users do not
choose a new independent password; rather, they choose an update of the old one. There is evidence to
suggest that users who are required to change their passwords frequently select weaker passwords to
begin with and then change them in predictable ways that attackers can guess easily.
>One study at the University of North Carolina found that 17% of new passwords could be guessed given
the old one in at most 5 tries, and almost 50% in a few seconds of un-throttled guessing. Furthermore,
cyber criminals generally exploit stolen passwords immediately.
[1]https://www.microsoft.com/en-us/research/wp-content/uploads/2016/06/Microsoft_Password_Guidance-1.pdf https://www.microsoft.com/en-us/research/wp-content/uploads/...
- solatic 6y ago> Experiments have shown that users do not choose a new independent password; rather, they choose an update of the old one. Such experiments clearly do not introduce the use of password managers which promote the generation of long passwords with high entropy. Specifically in the case of master login passwords, where the usage of a password manager isn't feasible (like Active Directory and Windows logins), this may be the case. And it still requires that the domain forbid PIN/biometric logins and thus result in people complaining about entering long passwords with entropy each time.
- teekert 6y agoIf only I could use my pw manager at the windows login prompt.
- jackson1442 6y agoExactly. My university requires a yearly password update. I have to manually enter my password to log into computers, print release stations, a billion domains that just use an LDAP connector instead of our Shibboleth page, servers after home directory wipes, etc. My password needs to be something I can quickly type, so I just use the same one (a strong, multiple-word passphrase) and add its validity period to the end. This actually makes hitting arbitrary password requirements easy too; make one word capitalized (or one lowercased), separate each with an allowed symbol, and the validity period is numeric so it passes just about every security check while being easy to type and remember.
- syntheticnature 6y agoIndeed, my work login password, with regular rotation requirements, has been dropping entropy by a few bits each time it comes up for renewal. I work to make my work passwords as different as I can, but that password doesn't get used enough for me to trivially remember it, and it can't be offloaded to a password manager easily.
- cyberpunk 6y agoI store a 32 char random string on a yubikey and have it setup so a “long press” on it enters it, works pretty well...
- Godel_unicode 6y agoI'm curious why you use this and not the Windows integration with yubikey? https://www.yubico.com/products/computer-login-tools/ https://www.yubico.com/products/computer-login-tools/
- cyberpunk 6y agoI'm on a Mac and couldn't be arsed setting it up properly ;) It's fairly easy to put a static OTP on two keys incase I lose one also instead of trying to register two with the OS. Also I can use it for various other things (like password manager secret etc) which don't support yubis out of the box.
- iso1631 6y agoI used my PW generated password on a site earlier, the site refused to accept it. 2^102 bit aren't enough (18 from 52 random upper/lower characters) aren't accepted, but P@55word was fine.
- andromeduck 6y agoPassword must between 6-12 characters... rips hair out
- ben0x539 6y agoThis is _specifically_ the one place where we require a rotating password too, so I think those experiments are informative.
- rozab 6y ago>cyber criminals almost always use credentials as soon as they compromise them. There's still the problem of breaches in unrelated services, which must be considered as part of the attack surface when users can just use a single password anywhere. This to me seems like the most obvious benefit of expiring passwords.
- lostcolony 6y agoJust have to hope that mypassword03 on the work account is not in sync with mypassword03 on the facebook account then. And that no one either automatically, or as part of a targeted attack, notices the 03 and tries 04 (and etc).
- pc86 6y agoIf users actually selected new passwords maybe. But they don't, they increment the number at the end or change the special character.
- Godel_unicode 6y agoFor those who may not know, password cracking/brute-force tools have all of this logic and more besides. Whatever human-rememberable algorithm people are using to rotate passwords, if an attacker knows a password they used at any point previously they'll get the new one quickly.
- Spooky23 6y agoNobody remembers real passwords so they come up with frameworks to have a pattern that meets policy. I did a consulting engagement a few years ago where we cracked 60% of passwords in a 40k user directory in under 3 hours, on a laptop. Every password met NIST complexity requirements of the time.
- iso1631 6y ago> Every password met NIST complexity requirements of the time. Would love to know how long it would take to crack 5ae2b1ce4999dfd2c8f1a57509650e75 as a password. Hell even 5ae2b1ce4999dfd2 is probably more secure than the majority of passwords chosen by users
- withinrafael 6y agoAnd NIST. https://pages.nist.gov/800-63-FAQ/#q-b05 https://pages.nist.gov/800-63-FAQ/#q-b05
- mattowen_uk 6y agoAnd NCSC: https://www.ncsc.gov.uk/collection/passwords/updating-your-approach https://www.ncsc.gov.uk/collection/passwords/updating-your-a...
- edlebert 6y agoAnd my ax!
- sharken 6y agoSo at least three reputable sources recommend not changing passwords periodically. Maybe that can persuade my employer though i doubt it. One aspect though is that some people tend to use the same password in multiple places and with passwords ending up in https://haveibeenpwned.com https://haveibeenpwned.com, you might argue for periodic password changes.
- deleted 6y ago[deleted]
- xxpor 6y agoMy understanding is the biggest driver of still having mandatory password rotation is PCI (the payments security requirements, not the bus)
- mywittyname 6y agoIt wouldn't surprise me if this were a regulation requirement, since most very large companies I've worked with all have pretty much identical password expiration policies.
- xxpor 6y agoPCI is, practically speaking, nearly the same as an actual regulation, given how stringent and widespread it is.
- jrodthree24 6y agoThis requirement can come from lots of places. I remember at the last place I worked, we had to get audited for SOC2 compliance and password expiry was part of the requirement. I imagine these things lag behind the recommended security guidelines by quite a few years.
- xmprt 6y agoIt feels extremely negligent of third party auditors to recommend (and sometimes require) companies to enforce worse, obsolete security practice.
- underwater 6y agoSOC 2 is defined by the American Institute of Certified Public Accountants. Having computer security defined by accountants seems crazy, but is in the style of the bureaucratic mess of modern enterprise.
- tracker1 6y agoDon't recall for SOC2 specifically, but a lot of the time, "best practices" suggestions and the requirements weren't the same, and people codified the suggestions internally, or the reviewers/auditors would.
- FredPret 6y agoInternet1...Internet2...etc
- TranceMan 6y agoIs this similar to Enigma decoding - whereby the 'encoding' key was reasonably predictable and not random due to new keys being required to be generated regularly?
- pbreit 6y agoMost password requirements are dumb. Six alphanumeric is OK.
- michaelcampbell 6y ago...40 years ago.
- Sohcahtoa82 6y agoProbably the second most wrong comment I've ever read in my 5 years on HN.
- pbreit 6y agoI've worked on a lot of important, widely-used software and 6+ alphanumeric has always been copacetic. While more esoteric requirements a major pain point.
- robbyking 6y ago> These policies drive users to very predictable passwords I used to do a lot of contract work for the Clarke County School District in Athens, GA. For "security" reasons they weren't able to create domain accounts for people who weren't full time employees, so I'd often have to track down the IT manager to gain access to servers I was working on. He eventually got sick of having to drop what he was doing a dozen times a day, so one day he just gave me his password: a dictionary word followed by the number 23. Eventually the password failed, and he gave me his new password: that same dictionary word followed by a 24. Fast forward a few years and I'm back installing some updates, and before I get to work he hands me a slip of paper, on which he had written Dictionaryword29.
- ifdefdebug 6y agoDid you just give away very predictable credentials from a very predictable person with full access to very predictable IT equipment?
- moron4hire 6y agoWith passwords that simple, it's crackable almost instantaneously without any preknowledge of the password format. That, coupled with the fact that systems get randomly attacked all the time, I doubt it's really that big of a deal. Attackers don't need hints on passwords, they don't need hints on targets. They just target everyone, and try all easy passwords.
- hsbauauvhabzb 6y agoIt depends on the context, if I have a hash it’s trivial to crack dictionaryword29, if I’m brute forcing a VPN/RDP endpoint, generally fail2ban are hard enough to block mass attempts (an AD default, iirc), the latter is usually solved by phishing which has the added benefit of MFA capture also. Pentester here, to clear any dubious assumptions.
- ivalm 6y agoBut if the password is salted is it still easy to crack?
- sn_master 6y agoThis been Google's guidance for even longer time, if not forever. I worked at Google for a year and was very surprised about that. Before that I had to find ways to memorize the new password every 60-90 days.
- technion 6y agoUnfortunately Microsoft was inconsistent with this advice. They published that article in 2016, however in 2018 I logged this issue regarding their published best practices: https://github.com/MicrosoftDocs/windows-itpro-docs/issues/559 https://github.com/MicrosoftDocs/windows-itpro-docs/issues/5...