4 ms·

> From my point of view I believe I can be trusted to reset my Apple ID quickly. A different, devil’s advocate perspective, might be that if you forgot you App

> From my point of view I believe I can be trusted to reset my Apple ID quickly. A different, devil’s advocate perspective, might be that if you forgot you Apple ID credentials, you should not be trusted to reset your Apple ID. I have passwords from 15+ years ago in my password safe. I have never needed to reset my Apple ID. The other thing to consider, is whether you’d be happy for an attacker to reset your Apple ID quickly. Apple lose a lot of credibility when iCloud started raining celebrity nudes to 4chan. They care less about you specifically as a user than they do about whole classes of users who’re much more likely to be phished and social engineered than you believe yourself to be…

icu 5y ago
As mentioned previously, the last Apple product I purchased was the iPad Gen 1 (2010). However, my security consciousness changed post Snowden (2013) and I devoted time and effort to study and implement strong infosec. This was about when I stopped using my Apple ID (so I'd estimate it's been about 8 years). That said, bragging that you haven't changed your passwords from 15+ years ago, even if they are securely stored, makes me question how serious you take your security. I change my passwords regularly, and it's accepted that this is best practice. As to your comment about an attacker being able to reset my password quickly, I think I should be given the option to if I wanted, or be allowed to provide KYC like passport or driving licence to fast track it. If I was a celebrity I might want to opt in to 'slow track' plus KYC verification. My point is about not having the option because it's Apple's way or the highway.
- Godel_unicode 5y ago
  > it's accepted that this is best practice It is absolutely not, and hasn't been for several years (source; I'm on the industry panel for many security standards). Every serious security standard (NIST, DoD, GCHQ, etc) say that choosing a strong password is important, but that periodically changing it brings at best no benefit. The overwhelming consensus in security is that using strong cryptographic secrets is the only really secure way to authenticate. Buy some kind of the tamper evident secret store and get on with your life. If you allow people to opt-out of security, they will do so and then scream when there's a breach that they made inevitable. Look at the discussion around HSTS for as many examples of this as you please; users cannot be trusted with their own security, they will at best leverage outdated and badly wrong guidance from years ago. More often, they will choose Summer2021 as a password and 000000 as a pin.
  - tatersolid 5y ago
    > they will choose Summer2021 as a password A few years ago when we started implementing the revision of NIST 800-63B we started checking user passwords against breach lists by hash. In a company of just a few hundred people, two unrelated employees had chosen exactly the same compromised password. After forcing a change, we asked them what their old password was. Summer2018! was chosen independently by two people in a smallish company who had never met.
    - Godel_unicode 5y ago
      I did an audit once where security confidently told us that there were no weak passwords given out by the helpdesk. When we actually tested hashes, we determined that there were a ton of the usual suspects. When we chatted up some helpdesk people over lunch, it turned out the problem was that they gave good passwords whenever someone from security asked because otherwise those jerks would scream at you. Everyone else in the company got easy passwords because it lowered call volumes. They literally were checking group membership as part of their reset script and giving the user the type of password which was most likely to get them to go away.
      - tatersolid 5y ago
        Your case has a significant difference: trained IT staff choosing weak passwords for convenience is much worse than “normal” users independently choosing weak credentials despite yearly training. That said, the root cause is the same: humans cannot remember computationally-secure credentials. We need something else. Pushing for “stronger passwords” is folly.
  - icu 5y ago
    My experience with not regularly changing passwords is that the security of your login credentials decays over time. If you keep track of when you changed your passwords you will know what time period you were compromised if you check a website like https://haveibeenpwned.com https://haveibeenpwned.com. If not, you'll might have to trust whatever PR says about when the breach occured. I agree that strong passwords and cryptographic storage is the way to go, but I think you go too far when you say "users cannot be trusted with their own security" because some can. I think it really depends on who your users are.

icu 5y ago

As mentioned previously, the last Apple product I purchased was the iPad Gen 1 (2010). However, my security consciousness changed post Snowden (2013) and I devoted time and effort to study and implement strong infosec. This was about when I stopped using my Apple ID (so I'd estimate it's been about 8 years). That said, bragging that you haven't changed your passwords from 15+ years ago, even if they are securely stored, makes me question how serious you take your security. I change my passwords regularly, and it's accepted that this is best practice. As to your comment about an attacker being able to reset my password quickly, I think I should be given the option to if I wanted, or be allowed to provide KYC like passport or driving licence to fast track it. If I was a celebrity I might want to opt in to 'slow track' plus KYC verification. My point is about not having the option because it's Apple's way or the highway.

Godel_unicode 5y ago
> it's accepted that this is best practice It is absolutely not, and hasn't been for several years (source; I'm on the industry panel for many security standards). Every serious security standard (NIST, DoD, GCHQ, etc) say that choosing a strong password is important, but that periodically changing it brings at best no benefit. The overwhelming consensus in security is that using strong cryptographic secrets is the only really secure way to authenticate. Buy some kind of the tamper evident secret store and get on with your life. If you allow people to opt-out of security, they will do so and then scream when there's a breach that they made inevitable. Look at the discussion around HSTS for as many examples of this as you please; users cannot be trusted with their own security, they will at best leverage outdated and badly wrong guidance from years ago. More often, they will choose Summer2021 as a password and 000000 as a pin.
- tatersolid 5y ago
  > they will choose Summer2021 as a password A few years ago when we started implementing the revision of NIST 800-63B we started checking user passwords against breach lists by hash. In a company of just a few hundred people, two unrelated employees had chosen exactly the same compromised password. After forcing a change, we asked them what their old password was. Summer2018! was chosen independently by two people in a smallish company who had never met.
  - Godel_unicode 5y ago
    I did an audit once where security confidently told us that there were no weak passwords given out by the helpdesk. When we actually tested hashes, we determined that there were a ton of the usual suspects. When we chatted up some helpdesk people over lunch, it turned out the problem was that they gave good passwords whenever someone from security asked because otherwise those jerks would scream at you. Everyone else in the company got easy passwords because it lowered call volumes. They literally were checking group membership as part of their reset script and giving the user the type of password which was most likely to get them to go away.
    - tatersolid 5y ago
      Your case has a significant difference: trained IT staff choosing weak passwords for convenience is much worse than “normal” users independently choosing weak credentials despite yearly training. That said, the root cause is the same: humans cannot remember computationally-secure credentials. We need something else. Pushing for “stronger passwords” is folly.
- icu 5y ago
  My experience with not regularly changing passwords is that the security of your login credentials decays over time. If you keep track of when you changed your passwords you will know what time period you were compromised if you check a website like https://haveibeenpwned.com https://haveibeenpwned.com. If not, you'll might have to trust whatever PR says about when the breach occured. I agree that strong passwords and cryptographic storage is the way to go, but I think you go too far when you say "users cannot be trusted with their own security" because some can. I think it really depends on who your users are.