7 ms·

>cyber criminals almost always use credentials as soon as they compromise them. There's still the problem of breaches in unrelated services, which must be cons

by rozab 6y ago

>cyber criminals almost always use credentials as soon as they compromise them. There's still the problem of breaches in unrelated services, which must be considered as part of the attack surface when users can just use a single password anywhere. This to me seems like the most obvious benefit of expiring passwords.

lostcolony 6y ago
Just have to hope that mypassword03 on the work account is not in sync with mypassword03 on the facebook account then. And that no one either automatically, or as part of a targeted attack, notices the 03 and tries 04 (and etc).
pc86 6y ago
If users actually selected new passwords maybe. But they don't, they increment the number at the end or change the special character.
- Godel_unicode 6y ago
  For those who may not know, password cracking/brute-force tools have all of this logic and more besides. Whatever human-rememberable algorithm people are using to rotate passwords, if an attacker knows a password they used at any point previously they'll get the new one quickly.
Spooky23 6y ago
Nobody remembers real passwords so they come up with frameworks to have a pattern that meets policy. I did a consulting engagement a few years ago where we cracked 60% of passwords in a 40k user directory in under 3 hours, on a laptop. Every password met NIST complexity requirements of the time.
- iso1631 6y ago
  > Every password met NIST complexity requirements of the time. Would love to know how long it would take to crack 5ae2b1ce4999dfd2c8f1a57509650e75 as a password. Hell even 5ae2b1ce4999dfd2 is probably more secure than the majority of passwords chosen by users
  - lstamour 6y ago
    Neither password is secure once it leaks, though. That’s the problem when people pick a secure password but then use it everywhere. This is why password managers are mandatory for secure passwords. iOS has the right approach: they suggest random passwords in Safari and explain why, then save them in a local hardware-encrypted store with biometric quick unlock. Downside of course is they also sync to Mac and don’t have the same usability in other contexts. Windows support was recently added, but is only as secure as the TPM option and firmware of your BIOS/CPU chips and given encryption requires Pro, it’s possible some security features also require Windows 10 Pro. I’m also not sure how iCloud for Windows communicates with Chrome or if that’s been documented somewhere. https://support.apple.com/en-ca/guide/icloud/mmfeee20145e/icloud https://support.apple.com/en-ca/guide/icloud/mmfeee20145e/ic... A permanent solution is to skip the password and just use biometrics and machine identity, such as with FIDO2. Obviously not required in every scenario, but much more secure than a re-used password, even one that hasn’t yet leaked, because it might still (be leaked due to re-use, that is). Add to that tracking of which machines and locations a user logs in to for flagging suspicious “I can’t access my account,” requests etc. Encourage users to log in from more than one device if they can to help regain access automatically if a device is lost or reformatted…
    - hda111 6y ago
      Is there any popular site that allows to only use FIDO2? I want to get rid of all passwords but it seems it’s not possible at the moment.
      - lstamour 6y ago
        Sign in with Apple, required by Apple for all apps with social logins, will only prompt you for a password when you don't have Face ID, Touch ID or a PIN set on your device, according to https://support.apple.com/en-ca/HT211687 https://support.apple.com/en-ca/HT211687 So that's effectively the same thing as if the site only used FIDO2 - because that's the same technology Apple uses within Safari and other web browsers to implement Sign in with Apple. You can do the same with your Microsoft account: https://www.microsoft.com/en-us/microsoft-365/blog/2018/11/20/sign-in-to-your-microsoft-account-without-a-password-using-windows-hello-or-a-security-key/ https://www.microsoft.com/en-us/microsoft-365/blog/2018/11/2... The big name left out of all this is Google. They seem to have embraced using passwords everywhere, except, oddly enough, on their passwords management website - https://security.googleblog.com/2019/08/making-authentication-even-easier-with_12.html https://security.googleblog.com/2019/08/making-authenticatio... Every once in awhile Google Chrome will prompt me to sign in with a password, skipping the 2FA check, just to validate my identity. It's kind of pointless, really. If they can't trust my device to be secure, why are they asking me to enter a password on my device? That just weakens my account's security if they legitimately couldn't trust my device... Better to have my device validate its ID and my ID via Windows Hello or the same FIDO2-style biometrics and call it a day.

by rozab 6y ago

lostcolony 6y ago

Just have to hope that mypassword03 on the work account is not in sync with mypassword03 on the facebook account then. And that no one either automatically, or as part of a targeted attack, notices the 03 and tries 04 (and etc).

pc86 6y ago

If users actually selected new passwords maybe. But they don't, they increment the number at the end or change the special character.

Godel_unicode 6y ago
For those who may not know, password cracking/brute-force tools have all of this logic and more besides. Whatever human-rememberable algorithm people are using to rotate passwords, if an attacker knows a password they used at any point previously they'll get the new one quickly.

Spooky23 6y ago

Nobody remembers real passwords so they come up with frameworks to have a pattern that meets policy. I did a consulting engagement a few years ago where we cracked 60% of passwords in a 40k user directory in under 3 hours, on a laptop. Every password met NIST complexity requirements of the time.

iso1631 6y ago
> Every password met NIST complexity requirements of the time. Would love to know how long it would take to crack 5ae2b1ce4999dfd2c8f1a57509650e75 as a password. Hell even 5ae2b1ce4999dfd2 is probably more secure than the majority of passwords chosen by users
- lstamour 6y ago
  Neither password is secure once it leaks, though. That’s the problem when people pick a secure password but then use it everywhere. This is why password managers are mandatory for secure passwords. iOS has the right approach: they suggest random passwords in Safari and explain why, then save them in a local hardware-encrypted store with biometric quick unlock. Downside of course is they also sync to Mac and don’t have the same usability in other contexts. Windows support was recently added, but is only as secure as the TPM option and firmware of your BIOS/CPU chips and given encryption requires Pro, it’s possible some security features also require Windows 10 Pro. I’m also not sure how iCloud for Windows communicates with Chrome or if that’s been documented somewhere. https://support.apple.com/en-ca/guide/icloud/mmfeee20145e/icloud https://support.apple.com/en-ca/guide/icloud/mmfeee20145e/ic... A permanent solution is to skip the password and just use biometrics and machine identity, such as with FIDO2. Obviously not required in every scenario, but much more secure than a re-used password, even one that hasn’t yet leaked, because it might still (be leaked due to re-use, that is). Add to that tracking of which machines and locations a user logs in to for flagging suspicious “I can’t access my account,” requests etc. Encourage users to log in from more than one device if they can to help regain access automatically if a device is lost or reformatted…
  - hda111 6y ago
    Is there any popular site that allows to only use FIDO2? I want to get rid of all passwords but it seems it’s not possible at the moment.
    - lstamour 6y ago
      Sign in with Apple, required by Apple for all apps with social logins, will only prompt you for a password when you don't have Face ID, Touch ID or a PIN set on your device, according to https://support.apple.com/en-ca/HT211687 https://support.apple.com/en-ca/HT211687 So that's effectively the same thing as if the site only used FIDO2 - because that's the same technology Apple uses within Safari and other web browsers to implement Sign in with Apple. You can do the same with your Microsoft account: https://www.microsoft.com/en-us/microsoft-365/blog/2018/11/20/sign-in-to-your-microsoft-account-without-a-password-using-windows-hello-or-a-security-key/ https://www.microsoft.com/en-us/microsoft-365/blog/2018/11/2... The big name left out of all this is Google. They seem to have embraced using passwords everywhere, except, oddly enough, on their passwords management website - https://security.googleblog.com/2019/08/making-authentication-even-easier-with_12.html https://security.googleblog.com/2019/08/making-authenticatio... Every once in awhile Google Chrome will prompt me to sign in with a password, skipping the 2FA check, just to validate my identity. It's kind of pointless, really. If they can't trust my device to be secure, why are they asking me to enter a password on my device? That just weakens my account's security if they legitimately couldn't trust my device... Better to have my device validate its ID and my ID via Windows Hello or the same FIDO2-style biometrics and call it a day.