4 ms·

I am in the camp of requiring people to have strong passwords, and not requiring them to be changed - ever. When you ask people to remember too many passwords,

by ejb999 5y ago

I am in the camp of requiring people to have strong passwords, and not requiring them to be changed - ever. When you ask people to remember too many passwords, they start writing them down and/or forgetting them, which leads to other problems. My oldest online account - btw it is a brokerage account at one of the big brokerage houses, where a great deal of my cash and investments sit - has not asked me to change the password in close to 25 years, which I find quite funny.

chimeracoder 5y ago
> When you ask people to remember too many passwords, they start writing them down and/or forgetting them, which leads to other problems. Writing passwords down isn't the worst thing. If you can't convince someone to use a password manager like 1Password, getting them to use a physical notebook of unique and strong passwords is actually the next best thing, because (combined with 2FA) it protects them against the most relevant threat models for most people (phishing and password stuffing).
- falcolas 5y ago
  A business card stored in a wallet or purse is pretty good too. After all, we're already pretty used to protecting our credit cards, identity cards, and cash.
  - Brian_K_White 5y ago
    It's pretty bad to put both a debit card and it's password together. The only reason it's even tolerable risk to walk around out in the wide random world with a debit or credit card on your person all day every day, is because somewhere else you have the means to disable it and declare it lost. This is like storing the keys to your car conveniently right on your car.
    - sj4nz 5y ago
      If anything it should be the "red herring" password that locks the account if retried too many times.
    - falcolas 5y ago
      That's an important corner case I overlooked. I still think it's easily solved using the same principles: there are places in our houses where we regularly store sensitive items in already as well, such as a filing cabinet, or key safe, or next to that emergency $100 in a book.
- kube-system 5y ago
  > Writing passwords down isn't the worst thing. At home maybe, but in other environments this can be pretty bad.
civilized 5y ago
Writing passwords down is inevitable. Having to remember more than two truly strong passwords is a ridiculous requirement to impose on the general population, and we live in a world where we need access to dozens of different accounts which ideally are supposed to all have different passwords. We either need password managers or we need to do away with passwords entirely.
- watwut 5y ago
  I will go further, expecting people to remember single strong password and change it every 3 months and not write it down is too much. Because after literally three rotation people will confuse previous and current password. And they will be out of memoizable ideas.
- splitstud 5y ago
gonzo41 5y ago
Your money is insured, your brokers are insured. They just manage the risk differently than people directly in the tech world. Even though banks are right in the middle of it. A good analogy for banks risk mitigation is like putting up a guard rail in front of a cliff. It's up to the user how high the rail gets set. Like daily limits, notifications, initial passwords, 2fa etc. For the most part, banks and brokers want to reduce the friction of events.
hombre_fatal 5y ago
I worked on a crypto-related project where we ended up just generating a strong password on the client during registration. Credential stuffing attacks are just too effective. Nobody complained. I think it's a better solution than making the user come up with their own strong password with annoying special character rules when you can just generate one for them. The interesting challenge was making it work well with all password managers though which often have mind-numbingly dumb heuristics about what could possibly be a password field. It's worth a blog post.
ozim 5y ago
The problem is how do you know that your password was not leaked or stolen? You don't know and that your brokerage did not ask you - it can mean anything, they might have had a breach already but they kept it secret. Idea about rotation of passwords is that you assume that your password 'was leaked/cracked' and you don't know about it and have no way knowing it.
- the_snooze 5y ago
  >Idea about rotation of passwords is that you assume that your password 'was leaked/cracked' and you don't know about it and have no way knowing it. That's really not the user's responsibility at that point. It's up to the service to store passwords securely (i.e., use proper password hashing functions) and monitor login behavior to throw up extra challenges if things look suspicious. Password rotation is a high-cost measure placed on the user that has little (even negative) benefit, especially when there are more effective alternatives the service is better-positioned to implement. Users cannot twist themselves into knots to make up for shitty service-side design decisions.
  - ozim 5y ago
    When I have right of way on the crossroads and I see truck coming with high speed from the side I am not going to drive in front of it and then claim, it was his responsibility to stop because I had "right of way". It is also no use when I am dead or severely wounded or all my money from account gone.

by ejb999 5y ago

chimeracoder 5y ago

> When you ask people to remember too many passwords, they start writing them down and/or forgetting them, which leads to other problems. Writing passwords down isn't the worst thing. If you can't convince someone to use a password manager like 1Password, getting them to use a physical notebook of unique and strong passwords is actually the next best thing, because (combined with 2FA) it protects them against the most relevant threat models for most people (phishing and password stuffing).

falcolas 5y ago
A business card stored in a wallet or purse is pretty good too. After all, we're already pretty used to protecting our credit cards, identity cards, and cash.
- Brian_K_White 5y ago
  It's pretty bad to put both a debit card and it's password together. The only reason it's even tolerable risk to walk around out in the wide random world with a debit or credit card on your person all day every day, is because somewhere else you have the means to disable it and declare it lost. This is like storing the keys to your car conveniently right on your car.
  - sj4nz 5y ago
    If anything it should be the "red herring" password that locks the account if retried too many times.
  - falcolas 5y ago
    That's an important corner case I overlooked. I still think it's easily solved using the same principles: there are places in our houses where we regularly store sensitive items in already as well, such as a filing cabinet, or key safe, or next to that emergency $100 in a book.
kube-system 5y ago
> Writing passwords down isn't the worst thing. At home maybe, but in other environments this can be pretty bad.

civilized 5y ago

Writing passwords down is inevitable. Having to remember more than two truly strong passwords is a ridiculous requirement to impose on the general population, and we live in a world where we need access to dozens of different accounts which ideally are supposed to all have different passwords. We either need password managers or we need to do away with passwords entirely.

watwut 5y ago
I will go further, expecting people to remember single strong password and change it every 3 months and not write it down is too much. Because after literally three rotation people will confuse previous and current password. And they will be out of memoizable ideas.
splitstud 5y ago

gonzo41 5y ago

Your money is insured, your brokers are insured. They just manage the risk differently than people directly in the tech world. Even though banks are right in the middle of it. A good analogy for banks risk mitigation is like putting up a guard rail in front of a cliff. It's up to the user how high the rail gets set. Like daily limits, notifications, initial passwords, 2fa etc. For the most part, banks and brokers want to reduce the friction of events.

hombre_fatal 5y ago

I worked on a crypto-related project where we ended up just generating a strong password on the client during registration. Credential stuffing attacks are just too effective. Nobody complained. I think it's a better solution than making the user come up with their own strong password with annoying special character rules when you can just generate one for them. The interesting challenge was making it work well with all password managers though which often have mind-numbingly dumb heuristics about what could possibly be a password field. It's worth a blog post.

ozim 5y ago

The problem is how do you know that your password was not leaked or stolen? You don't know and that your brokerage did not ask you - it can mean anything, they might have had a breach already but they kept it secret. Idea about rotation of passwords is that you assume that your password 'was leaked/cracked' and you don't know about it and have no way knowing it.

the_snooze 5y ago
>Idea about rotation of passwords is that you assume that your password 'was leaked/cracked' and you don't know about it and have no way knowing it. That's really not the user's responsibility at that point. It's up to the service to store passwords securely (i.e., use proper password hashing functions) and monitor login behavior to throw up extra challenges if things look suspicious. Password rotation is a high-cost measure placed on the user that has little (even negative) benefit, especially when there are more effective alternatives the service is better-positioned to implement. Users cannot twist themselves into knots to make up for shitty service-side design decisions.
- ozim 5y ago
  When I have right of way on the crossroads and I see truck coming with high speed from the side I am not going to drive in front of it and then claim, it was his responsibility to stop because I had "right of way". It is also no use when I am dead or severely wounded or all my money from account gone.