5 ms·

Due to the nature of my job and the age of some of my coworkers, I am sometimes casually given passwords on a piece of paper. Out of a sample size of conservati

Due to the nature of my job and the age of some of my coworkers, I am sometimes casually given passwords on a piece of paper. Out of a sample size of conservatively 20, I have never even once (!) seen a special character other than !. It just doesn't happen. Password rules and a requirement to change your password every X months are pure security mirage and just create frustration in people who often struggle to generate even one secure password in their entire lifetime. (Yes I evangelize password managers around here. So far I've converted 2-3 people. They are the important people with shit people might want to steal on their computers/accounts, so I'm happy with this.)

frosted-flakes 5y ago
Requirements for uppercase letters, numbers, and special characters mean I stick an "A1!" at the end of my otherwise strong and memorable password. I'm sure I'm not the only one.
- Ajedi32 5y ago
  Yeah, at least there's a good work-around for the numbers/symbols requirement. What's more annoying is when sites have a low maximum length so you _have_ to use special characters to get good entropy, or when they have other bizarre requirements like "can't contain more than 3 of the same character".
  - bluGill 5y ago
    Todays computers can brute force passwords of their maximum length in a few hours. I suppose someone somewhere has a maximum length that is hard to brute force, but I've never seen it.
    - tmountain 5y ago
      What max length? Once a password reaches 128 bits of entropy the key space is unfathomably large. You could have a password of length 1 with 10^100 possible values, and it could take a VERY long time to crack. In short, it has nothing to do with length, it has to do with bits of entropy, and there are still very real limits to what even the most powerful computers can brute force. Several years back, it was stated by Peerio that an 81-bit password would cost a billion dollars to crack. It becomes less feasible and more expensive from there.
      - bluGill 5y ago
        8 character, upper lower case, ten numbers, and about fifteen special symbols. About 6 bits per character. Most limits are 8 characters, so around 40 bits. More or less depending on the exact rules used. That assumes true random passwords, most attackers can make some educated guesses and cut the problem space, but that isn't a true brute force.
- passer_byer 5y ago
  You would be correct. Mine is "#1". I use compound english words whose meaning is non-sensical in a conversation but easy to remember.
handrous 5y ago
> Password rules and a requirement to change your password every X months are pure security mirage and just create frustration in people who often struggle to generate even one secure password in their entire lifetime. Every place I've ever seen or heard about with a "change every X months" system, everyone just uses a (often shared!) formula to come up with variations that satisfy the is-this-too-close-to-your-last-X-passwords checker, based on the date or whatever.
- kayodelycaon 5y ago
  I got up to P@ssW0rd12 at one job.
  - Arrath 5y ago
    I was working my way to it, when IT rolled out a new policy of "cannot share more than 2 consecutive characters with a previous password" or something like it, included in an email along the lines of "an audit has found this new policy applies to you". Dicks.
    - godshatter 5y ago
      Doesn't that imply that the are saving your previous passwords in plain text somewhere instead of saving hashes of them? How is this more secure?
      - GuB-42 5y ago
        Usually, when you change your password, you have to enter your old password. With both plaintexts, the check is trivial. It also means it should be possible to bypass that by changing the password twice or by "forgetting" your old password. Another possibility is that they simply lie to you and the rule that is actually checked is much more permissive. I've often seen requirements that are not actually checked
      - dr_kiszonka 5y ago
        This would be my guess too. Alternatively, maybe they save hashes of all substrings of length > 2 and check all hashed substrings of the new password against them. (Which - in my limited understanding of infosec - would be only marginally better than plaintext, but I can be wrong.)
BeFlatXIII 5y ago
Frequent password rotation causes increases of passwords on post-its stuck to the monitor.
- kevincox 5y ago
  In most cases I would take a strong password stuck to the monitor than a dictionary password on an internet exposed system. But yeah, frequent password rotation is still bad.
  - BeFlatXIII 5y ago
    Fair point. If your passwords are compromised because they were stuck to the monitor, that means physical security was breached and the copied passwords are now the least of your concerns.
scrooched_moose 5y ago
Sounds like we have similar roles. I've never gotten them on paper, but multiple times a month I get emails along the lines of "My account doesn't work. My password is Banana1. Please fix". Every time I reset every single password they have (at least 4 hours of work for them) and inform them not to share passwords. Still, I've had users do it multiple times. I finally got all of our admin/root passwords into a password manager with sharing among job functions and our CTO as backup to ensure some level of continuity. After losing passwords to multiple production systems after someone leaving the company it was still a battle.
- rudian 5y ago
  Congrats on getting them to use a password manager, now everyone can see all of their password by typing in the master password they stuck to the side of the screen. I'm only half-joking sadly, people just don't understand why password exist in the first place, so they comply maliciously.
  - vlunkr 5y ago
    I'm sure people do that, but the fact that they only have one password to remember, and (hopefully) don't have to rotate it would hopefully deter them

frosted-flakes 5y ago

Requirements for uppercase letters, numbers, and special characters mean I stick an "A1!" at the end of my otherwise strong and memorable password. I'm sure I'm not the only one.

Ajedi32 5y ago
Yeah, at least there's a good work-around for the numbers/symbols requirement. What's more annoying is when sites have a low maximum length so you _have_ to use special characters to get good entropy, or when they have other bizarre requirements like "can't contain more than 3 of the same character".
- bluGill 5y ago
  Todays computers can brute force passwords of their maximum length in a few hours. I suppose someone somewhere has a maximum length that is hard to brute force, but I've never seen it.
  - tmountain 5y ago
    What max length? Once a password reaches 128 bits of entropy the key space is unfathomably large. You could have a password of length 1 with 10^100 possible values, and it could take a VERY long time to crack. In short, it has nothing to do with length, it has to do with bits of entropy, and there are still very real limits to what even the most powerful computers can brute force. Several years back, it was stated by Peerio that an 81-bit password would cost a billion dollars to crack. It becomes less feasible and more expensive from there.
    - bluGill 5y ago
      8 character, upper lower case, ten numbers, and about fifteen special symbols. About 6 bits per character. Most limits are 8 characters, so around 40 bits. More or less depending on the exact rules used. That assumes true random passwords, most attackers can make some educated guesses and cut the problem space, but that isn't a true brute force.
passer_byer 5y ago
You would be correct. Mine is "#1". I use compound english words whose meaning is non-sensical in a conversation but easy to remember.

handrous 5y ago

> Password rules and a requirement to change your password every X months are pure security mirage and just create frustration in people who often struggle to generate even one secure password in their entire lifetime. Every place I've ever seen or heard about with a "change every X months" system, everyone just uses a (often shared!) formula to come up with variations that satisfy the is-this-too-close-to-your-last-X-passwords checker, based on the date or whatever.

kayodelycaon 5y ago
I got up to P@ssW0rd12 at one job.
- Arrath 5y ago
  I was working my way to it, when IT rolled out a new policy of "cannot share more than 2 consecutive characters with a previous password" or something like it, included in an email along the lines of "an audit has found this new policy applies to you". Dicks.
  - godshatter 5y ago
    Doesn't that imply that the are saving your previous passwords in plain text somewhere instead of saving hashes of them? How is this more secure?
    - GuB-42 5y ago
      Usually, when you change your password, you have to enter your old password. With both plaintexts, the check is trivial. It also means it should be possible to bypass that by changing the password twice or by "forgetting" your old password. Another possibility is that they simply lie to you and the rule that is actually checked is much more permissive. I've often seen requirements that are not actually checked
    - dr_kiszonka 5y ago
      This would be my guess too. Alternatively, maybe they save hashes of all substrings of length > 2 and check all hashed substrings of the new password against them. (Which - in my limited understanding of infosec - would be only marginally better than plaintext, but I can be wrong.)

BeFlatXIII 5y ago

Frequent password rotation causes increases of passwords on post-its stuck to the monitor.

kevincox 5y ago
In most cases I would take a strong password stuck to the monitor than a dictionary password on an internet exposed system. But yeah, frequent password rotation is still bad.
- BeFlatXIII 5y ago
  Fair point. If your passwords are compromised because they were stuck to the monitor, that means physical security was breached and the copied passwords are now the least of your concerns.

scrooched_moose 5y ago

Sounds like we have similar roles. I've never gotten them on paper, but multiple times a month I get emails along the lines of "My account doesn't work. My password is Banana1. Please fix". Every time I reset every single password they have (at least 4 hours of work for them) and inform them not to share passwords. Still, I've had users do it multiple times. I finally got all of our admin/root passwords into a password manager with sharing among job functions and our CTO as backup to ensure some level of continuity. After losing passwords to multiple production systems after someone leaving the company it was still a battle.

rudian 5y ago
Congrats on getting them to use a password manager, now everyone can see all of their password by typing in the master password they stuck to the side of the screen. I'm only half-joking sadly, people just don't understand why password exist in the first place, so they comply maliciously.
- vlunkr 5y ago
  I'm sure people do that, but the fact that they only have one password to remember, and (hopefully) don't have to rotate it would hopefully deter them