3 ms·

Cybersecurity is a large set of security concerns and password strength is only one of them. This is mostly a solved problem and a minor consideration when stor

Cybersecurity is a large set of security concerns and password strength is only one of them. This is mostly a solved problem and a minor consideration when store the passwords correctly on the backend (https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html https://cheatsheetseries.owasp.org/cheatsheets/Password_Stor..., have reasonable password restrictions (16 characters, no complexity, changes once or twice a year "just in case"), ideally a basic checker when people set their passwords (against a leaked passwords db such as rockyou) and correct identity management (especially disabling an account when the user leaves). There is really nothing exciting in that part of cybersecurity and with the above in place you are safe and can move towards the real risks. Online password cracking does not matter in practical terms and for offline one you have other problems to urgently address. What are these risks depends on who you are but if you address aggressive, stubborn and coercive patching + development security (if you develop) + enthusiastic awareness you are ahead of 99% of the world already. Add to this some endpoint protection and monitoring of the events and, man, you are a company I can trust my HN rep.

stouset 3y ago
> changes once or twice a year Please stop cargo culting this.
- BrandoElFollito 3y ago
  Could you please expand your thought?
  - deleted 3y ago
    [deleted]
  - EE84M3i 3y ago
    NIST says: > “Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.” They also don't recommend having rules about like, a certain number of symbols, etc. https://pages.nist.gov/800-63-FAQ/#q-b05 https://pages.nist.gov/800-63-FAQ/#q-b05
  - tnbp 3y ago
    You should not require users to change their passwords periodically, as this will piss them off and make them use many weak passwords rather than one strong password. Only require a password change when there is reason to believe their old password has been compromised.
  - px43 3y ago
    tnbp nailed it To explain the other side of the comment, "cargo cult security" refers to some groups of tribal people in New Guinea who build giant wooden airplanes and control towers in the hopes of attracting airplanes delivering food[1][2]. It's very common in the security space for people who have zero understanding of underlying security models to build elaborate structures that kind of look like and feel like they're doing security, but it's actually providing no value. These practices get blindly passed on for decades despite all the best effort of actual experts to explain to them why the practices are, in fact, completely useless. Password rotation is a mindbogglingly persistent one, as described in the other comment. [1] https://www.youtube.com/watch?v=qmlYe2KS0-Y https://www.youtube.com/watch?v=qmlYe2KS0-Y [2] https://en.wikipedia.org/wiki/Cargo_cult https://en.wikipedia.org/wiki/Cargo_cult
orev 3y ago
It says right in the intro that the goal is part of penetration testing, which is about far more than just your web app. The target is typically to compromise the central IDM (e.g. Active Directory) get the password database which contains hashed passwords, then crack those to allow further movement or escalation around a network. This could happen via a vulnerability that allows a normal user to get the database, and then cracking the admin password from there. So many people these days seem to completely forget that not everything is in the cloud, and there are many services in a company that you don’t see as a regular user or developer.

stouset 3y ago

> changes once or twice a year Please stop cargo culting this.

BrandoElFollito 3y ago
Could you please expand your thought?
- deleted 3y ago
  [deleted]
- EE84M3i 3y ago
  NIST says: > “Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.” They also don't recommend having rules about like, a certain number of symbols, etc. https://pages.nist.gov/800-63-FAQ/#q-b05 https://pages.nist.gov/800-63-FAQ/#q-b05
- tnbp 3y ago
  You should not require users to change their passwords periodically, as this will piss them off and make them use many weak passwords rather than one strong password. Only require a password change when there is reason to believe their old password has been compromised.
- px43 3y ago
  tnbp nailed it To explain the other side of the comment, "cargo cult security" refers to some groups of tribal people in New Guinea who build giant wooden airplanes and control towers in the hopes of attracting airplanes delivering food[1][2]. It's very common in the security space for people who have zero understanding of underlying security models to build elaborate structures that kind of look like and feel like they're doing security, but it's actually providing no value. These practices get blindly passed on for decades despite all the best effort of actual experts to explain to them why the practices are, in fact, completely useless. Password rotation is a mindbogglingly persistent one, as described in the other comment. [1] https://www.youtube.com/watch?v=qmlYe2KS0-Y https://www.youtube.com/watch?v=qmlYe2KS0-Y [2] https://en.wikipedia.org/wiki/Cargo_cult https://en.wikipedia.org/wiki/Cargo_cult

orev 3y ago

It says right in the intro that the goal is part of penetration testing, which is about far more than just your web app. The target is typically to compromise the central IDM (e.g. Active Directory) get the password database which contains hashed passwords, then crack those to allow further movement or escalation around a network. This could happen via a vulnerability that allows a normal user to get the database, and then cracking the admin password from there. So many people these days seem to completely forget that not everything is in the cloud, and there are many services in a company that you don’t see as a regular user or developer.