4 ms·

The nightmares that normally come with govt stuff in this space I'm seeing. 1) Long passwords - govt loves these - think 12 characters or longer. Think "EhKx~9

The nightmares that normally come with govt stuff in this space I'm seeing. 1) Long passwords - govt loves these - think 12 characters or longer. Think "EhKx~9RDmPMCW7" 2) Failures to specify allowable characters or blocked characters - very annoying. 3) Hard lockouts (rather than more nuanced rate limiting etc) requiring password resets. 4) Password reset options are weak and not protected. The backdoor is usually the password reset option. Ie, agency will do crazy long password + SMS code to login, but you can then reset your password with just SMS. So the long passwords are often just for show. They often also don't time delay anything. So they'll do things like immediate reset. For high value apps you should have a 4 - 24 hour delay on reset to allow legit user to react. They'll also often not have good ways to report bad password reset attempts other than via phone which goes no where. They also often actively block password managers and cutting and pasting passwords. So annoying. The IRS is currently requiring 90 day password rotations as well which are a nightmare. Coupled with hard account lockouts you have another nightmare. The list goes on. For the millions to billions they spend you really wonder who is giving them advice.

anonymousisme 5y ago
The requirement to frequently change a perfectly good password is nonsense. https://pages.nist.gov/800-63-FAQ/#q-b05 https://pages.nist.gov/800-63-FAQ/#q-b05 It says: SP 800-63B Section 5.1.1.2 paragraph 9 states: “Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.” Users tend to choose weaker memorized secrets when they know that they will have to change them in the near future. When those changes do occur, they often select a secret that is similar to their old memorized secret by applying a set of common transformations such as increasing a number in the password. This practice provides a false sense of security if any of the previous secrets has been compromised since attackers can apply these same common transformations. But if there is evidence that the memorized secret has been compromised, such as by a breach of the verifier’s hashed password database or observed fraudulent activity, subscribers should be required to change their memorized secrets. However, this event-based change should occur rarely, so that they are less motivated to choose a weak secret with the knowledge that it will only be used for a limited period of time.
- slownews45 5y ago
  "is nonsense" What a total lie. Do people actually work in / with govt who makes these statements? I just looked up a the current IRS checklist we've been forced to comply with which has driven lots of downline changes to all systems touching this system. "Control access to sensitive information by requiring employees to use “strong” passwords that *must be changed on a regular basis.". This is not an option, and regular has been defined as 90 days. A previous job (yes, I'm totally aware of NIST guidance) they forced a move to 30 days. 30 days with 12 character passwords is a joke and they blocked copy and paste. EVERY password was on sticky notes by computers after that. They are $100M system implementations. My point remains, the implementations of these things in the govt space is often the stuff of nightmares, and I have no idea who they are listening to for the money they spend.
  - fouric 5y ago
    Can confirm, I have a friend who works as a federal agency employee (a different one than the IRS), and she constantly has to change her passwords - her agency DGAF about SP 800-63B Section 5.1.1.2 paragraph 9 (or, in fact, many of the other NIST password recommendations). GP comment is absolutely false.
    - slownews45 5y ago
      What I don't get is we are getting NEW password rotation requirements on existing systems as part of the cyber protection pushes. We are way down the stack of course but just a basic approach like 1) Allow for cut and paste passwords 2) Reduce rotation requirements (even annually would be better). 3) 2FA if logging in from a new device (with no SMS) Would I'm sure get tons of protection without the insanity we have now. Some folks are asking for 16 character passwords but allow reset with a text message or email? Or a phone call to an overwhelmed help desk who barely verifies anything. That said, I've seen worse. I once tried to go as high as I could on the chain to get something even worse fixed (we were required to hand out a form for a program that had been out of existence for 5 years so form did nothing). They would not budge, I even got legal in on it. Because someone somewhere had ordered the form be distributed, the order had not been revoked, we still had to hand it out even though everyone agreed the form and program were no longer in existence. After I kept on escalating they threatened to prosecute or violate contract if form was not distributed an I kept pursuing the issue. So thousands of people filled out a form that just went no where.
swiley 5y ago
>3) Hard lockouts (rather than more nuanced rate limiting etc) requiring password resets. >4) Password reset options are weak and not protected. These are pretty much impossible to both satisfy. At the end of the day you need to think of computer accounts as ephemeral or have some out of band access to the administrative staff.
AtlasBarfed 5y ago
"The backdoor is usually the password reset option." County Password Inspector!

anonymousisme 5y ago

The requirement to frequently change a perfectly good password is nonsense. https://pages.nist.gov/800-63-FAQ/#q-b05 https://pages.nist.gov/800-63-FAQ/#q-b05 It says: SP 800-63B Section 5.1.1.2 paragraph 9 states: “Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.” Users tend to choose weaker memorized secrets when they know that they will have to change them in the near future. When those changes do occur, they often select a secret that is similar to their old memorized secret by applying a set of common transformations such as increasing a number in the password. This practice provides a false sense of security if any of the previous secrets has been compromised since attackers can apply these same common transformations. But if there is evidence that the memorized secret has been compromised, such as by a breach of the verifier’s hashed password database or observed fraudulent activity, subscribers should be required to change their memorized secrets. However, this event-based change should occur rarely, so that they are less motivated to choose a weak secret with the knowledge that it will only be used for a limited period of time.

slownews45 5y ago
"is nonsense" What a total lie. Do people actually work in / with govt who makes these statements? I just looked up a the current IRS checklist we've been forced to comply with which has driven lots of downline changes to all systems touching this system. "Control access to sensitive information by requiring employees to use “strong” passwords that *must be changed on a regular basis.". This is not an option, and regular has been defined as 90 days. A previous job (yes, I'm totally aware of NIST guidance) they forced a move to 30 days. 30 days with 12 character passwords is a joke and they blocked copy and paste. EVERY password was on sticky notes by computers after that. They are $100M system implementations. My point remains, the implementations of these things in the govt space is often the stuff of nightmares, and I have no idea who they are listening to for the money they spend.
- fouric 5y ago
  Can confirm, I have a friend who works as a federal agency employee (a different one than the IRS), and she constantly has to change her passwords - her agency DGAF about SP 800-63B Section 5.1.1.2 paragraph 9 (or, in fact, many of the other NIST password recommendations). GP comment is absolutely false.
  - slownews45 5y ago
    What I don't get is we are getting NEW password rotation requirements on existing systems as part of the cyber protection pushes. We are way down the stack of course but just a basic approach like 1) Allow for cut and paste passwords 2) Reduce rotation requirements (even annually would be better). 3) 2FA if logging in from a new device (with no SMS) Would I'm sure get tons of protection without the insanity we have now. Some folks are asking for 16 character passwords but allow reset with a text message or email? Or a phone call to an overwhelmed help desk who barely verifies anything. That said, I've seen worse. I once tried to go as high as I could on the chain to get something even worse fixed (we were required to hand out a form for a program that had been out of existence for 5 years so form did nothing). They would not budge, I even got legal in on it. Because someone somewhere had ordered the form be distributed, the order had not been revoked, we still had to hand it out even though everyone agreed the form and program were no longer in existence. After I kept on escalating they threatened to prosecute or violate contract if form was not distributed an I kept pursuing the issue. So thousands of people filled out a form that just went no where.

swiley 5y ago

>3) Hard lockouts (rather than more nuanced rate limiting etc) requiring password resets. >4) Password reset options are weak and not protected. These are pretty much impossible to both satisfy. At the end of the day you need to think of computer accounts as ephemeral or have some out of band access to the administrative staff.

AtlasBarfed 5y ago

"The backdoor is usually the password reset option." County Password Inspector!