4 ms·

Please stop saying "change your password regularly". Despite being a theoretical security increase, it has been shown repeatedly that it is a practical security

Please stop saying "change your password regularly". Despite being a theoretical security increase, it has been shown repeatedly that it is a practical security decrease as it encourages both simpler passwords and incremental passwords. It also makes your users hate you, which isn't great. A security company should know this. It's been strictly recommended against in the NIST guidelines (and others) for nearing a decade now. I start to really question the expertise of any security company that parrots this outdated advice. What else are they not keeping up on? Focus on monitoring, alerting, educating, etc. Force password changes only when there are indicators of compromise.

beardedwizard 2y ago
I would have thought the advice here would be use passkeys everywhere you can and avoid Totp altogether (particularly the sms variant which has real risks today). When I think big picture mfa exists because passwords are often assumed lost to infostealers, so changing your password seems moot for an adversary who is ready to brute force your mfa.
- ezekg 2y ago
  > I would have thought the advice here would be use passkeys everywhere you can and avoid Totp altogether (particularly the sms variant which has real risks today). Why would you avoid TOTP altogether? Yes, SMS OTP is insecure because SMS is insecure, but OTP itself is fine, unless I missed something?
  - computerfriend 2y ago
    TOTP is phishable.
- halfcat 2y ago
  Passkeys address the phishing angle, but as always it’s a trade off. With passkeys if someone gets remote control of your computer they have access to everything you setup a passkey for. Typically people say “well full remote control is far less common than phishing”, and it is, for now, until everyone’s using passkeys and all of the sophisticated phishing attack effort just shifts to passkeys. The obvious weak point here is all of the outsourced IT who aren’t specifically focused on cybersecurity. Every IT company is using multiple tools for central management that either allows remote control or remote execution, or there’s always in-house developers who realistically aren’t doing a security analysis of every third-party library they’re installing.
  - beardedwizard 2y ago
    You can still require biometric to unlock passkey for each use, so the risk is really about authenticated session theft in that scenario
dylan604 2y ago
> It's been strictly recommended against in the NIST guidelines (and others) for nearing a decade now. And yet it is still the recommended practice for every IT department for pretty much all corps. Even AWS has their forced 90 password reset policy where you start to get reminders 15 days early so it's actually 75 days. Only at AWS, they don't force you into the password rotation flow at the end of the 90, they automatically lock the account. While that might make sense for inactive accounts, for accounts that have clicked the Not Now for 14 days should be taken to a change password screen instead. /rant
- ziddoap 2y ago
  >And yet it is still the recommended practice for every IT department for pretty much all corps Not any that I or my colleagues consult at.
  - dylan604 2y ago
    well congratulations to you. do you like to kick people when they're down to make yourself feel superior or was there another point to your comment? Great there's at least 3 companies that do not have this policy. That in no way negates all of the companies that do.
    - ziddoap 2y ago
      This is a really hostile comment. Sorry that your upset, but you don't need to take it out on me. >or was there another point to your comment? The purpose of my comment was to refute your claim that arbitrary password resets is the "recommended practice for every IT department for pretty much all corps". Because it's not true. >Great there's at least 3 companies that do not have this policy. Between me and my colleagues we consult at dozens to hundreds of corporations per year. "At least 3" is pretty disingenuous.
      - dylan604 2y ago
        sarcastic. not hostile. do you honestly believe that i was unaware that there are companies that do not require the rotation policy? maybe the "pretty much all" phrase was confusing and you did not think that left room for some to not? that's great that there are some companies that do not, but there are a great number of people that still do. it's not anything that needs rebutting as we're all aware they exist
nine_k 2y ago
Another measure is to use a password manager and long, random, unguessable passwords. With no need to memorize passwords, you can change them as often as you fancy.
- ziddoap 2y ago
  >_you_ can change them as often as _you_ fancy. This is all that matters, regardless of whether a password manager is used or not. Users should be able to change their own password (almost) whenever they want. But arbitrary forced password changes from the admin should not happen unless the account has indicators of being compromised (even if all of your users have a password manager).
  - nashashmi 2y ago
    I run into issues where the password manager doesn’t update. And I also now have 4 managers (lastpass; chrome; edge; icloud keys) because of multiple platforms over the years.
    - nine_k 2y ago
      I bit the bullet and moved everything to BitWarden. (The idea is that I could self-host it if the service becomes problematic.)
Workaccount2 2y ago
Our organization contracts out our IT, I can cannot stress enough how bad/lazy their cyber security guys are. It feels like the owner told his directionless son "Hey boy, if you manage to pass this cert class I'll make you head of cyber security!" Every few months we need to change our password. It cannot be a previously used password. It needs uppercase, lowercase, number, special character and minimum 12 characters. We have 2FA that is easily bypassed by going offline then back online once through login. We have 4 different active security suites running on our machines, and mandatory biweekly virus scans, at 10am (which cannot be changed). Every standard 16GB machine runs on it's knees all day long. But at least you can skip 2fa by turning off wifi real fast.
- formerly_proven 2y ago
  We made IT security a checklist compliance exercise and call it cybersecurity, and then we are shocked and surprised the main deliverable turns out to be checked checklists, not security.
  - nonrandomstring 2y ago
    Don't stop there. You can make some even greater efficiencies. By having cyber-insurance you can do nothing and just have someone pay you out money when you fuck up. There's no end of ways security theatre and half-arsed "compliance" can help lower standards,
    - quacksilver 2y ago
      To be fair, if using insurance and risking being hacked anyway has a higher expected net payoff than implementing a given set of security measures, then you may be financially incentivized (or legally beholden to your shareholders) to take the risk, get hacked and pay any fines if it gets discovered. The security literature refers to it as "risk transference". Chances are your company ultimately exists to optimize for shareholder value
- SketchySeaBeast 2y ago
  I personally can't imagine trying to be a cybersecurity person. I'd be going out of my mind, concerned with all the things I can't keep up with. As a full stack dev, if I don't know what's new in React 19 it doesn't really hurt anybody, but if the cybersecurity people aren't up to date, that could very well be the end of the company. Either you're hot shit, just think you're hot shit, or you simply don't care, and that blend really scares me.
nashashmi 2y ago
I think when compared with a breach in 2FA, changing your password is a good counter. But I agree that in the case of failed 2FA (total failure), an alert should be sent to the user: "password used to access account; but second factor authentication was unsuccessful; change password if this was not you".
deleted 2y ago
[deleted]
brookst 2y ago
For places that enforce password changes, I can always tell how old my account is by (password change frequency) * (counter I put at end of password). My actual password choices are secure, memorable, and available even if I lose my phone or password manager. The counter is just an annoyance.
- Goronmon 2y ago
  For places that enforce password changes, I can always tell how old my account is by (password change frequency) * (counter I put at end of password). I can't because there is generally a limit to how many passwords it checks for previous use. So you can usually just start back at "1" for the increment after you hit "0".
  - SAI_Peregrinus 2y ago
    I just use a strong PascalCase passphrase (as strong as feasible if they have a stupidly short limit) and the year & month of the last password change. Something like `PascalCasePassphraseButRandomlyGeneratedProperly2024-12` for one this month. Fits many composition rules (those are also recommended against) by having uppercase, lowercase, numbers, and punctuation. Doesn't repeat previous passwords. And the entropy of the actual 7-word diceware passphrase is about 90 bits, which is pretty decent.
quacksilver 2y ago
It used to be a good idea with things like AD, where pass-the-hash attacks worked and hashes would be static until changed, and in environments where hashes were relatively exposed for cracking and used weak hashes. Hopefully that is not the case now though, and I am surprised the advice has persisted... (though outdated gov standards probably played a part until recently)

beardedwizard 2y ago

I would have thought the advice here would be use passkeys everywhere you can and avoid Totp altogether (particularly the sms variant which has real risks today). When I think big picture mfa exists because passwords are often assumed lost to infostealers, so changing your password seems moot for an adversary who is ready to brute force your mfa.

ezekg 2y ago
> I would have thought the advice here would be use passkeys everywhere you can and avoid Totp altogether (particularly the sms variant which has real risks today). Why would you avoid TOTP altogether? Yes, SMS OTP is insecure because SMS is insecure, but OTP itself is fine, unless I missed something?
- computerfriend 2y ago
  TOTP is phishable.
halfcat 2y ago
Passkeys address the phishing angle, but as always it’s a trade off. With passkeys if someone gets remote control of your computer they have access to everything you setup a passkey for. Typically people say “well full remote control is far less common than phishing”, and it is, for now, until everyone’s using passkeys and all of the sophisticated phishing attack effort just shifts to passkeys. The obvious weak point here is all of the outsourced IT who aren’t specifically focused on cybersecurity. Every IT company is using multiple tools for central management that either allows remote control or remote execution, or there’s always in-house developers who realistically aren’t doing a security analysis of every third-party library they’re installing.
- beardedwizard 2y ago
  You can still require biometric to unlock passkey for each use, so the risk is really about authenticated session theft in that scenario

dylan604 2y ago

> It's been strictly recommended against in the NIST guidelines (and others) for nearing a decade now. And yet it is still the recommended practice for every IT department for pretty much all corps. Even AWS has their forced 90 password reset policy where you start to get reminders 15 days early so it's actually 75 days. Only at AWS, they don't force you into the password rotation flow at the end of the 90, they automatically lock the account. While that might make sense for inactive accounts, for accounts that have clicked the Not Now for 14 days should be taken to a change password screen instead. /rant

ziddoap 2y ago
>And yet it is still the recommended practice for every IT department for pretty much all corps Not any that I or my colleagues consult at.
- dylan604 2y ago
  well congratulations to you. do you like to kick people when they're down to make yourself feel superior or was there another point to your comment? Great there's at least 3 companies that do not have this policy. That in no way negates all of the companies that do.
  - ziddoap 2y ago
    This is a really hostile comment. Sorry that your upset, but you don't need to take it out on me. >or was there another point to your comment? The purpose of my comment was to refute your claim that arbitrary password resets is the "recommended practice for every IT department for pretty much all corps". Because it's not true. >Great there's at least 3 companies that do not have this policy. Between me and my colleagues we consult at dozens to hundreds of corporations per year. "At least 3" is pretty disingenuous.
    - dylan604 2y ago
      sarcastic. not hostile. do you honestly believe that i was unaware that there are companies that do not require the rotation policy? maybe the "pretty much all" phrase was confusing and you did not think that left room for some to not? that's great that there are some companies that do not, but there are a great number of people that still do. it's not anything that needs rebutting as we're all aware they exist

nine_k 2y ago

Another measure is to use a password manager and long, random, unguessable passwords. With no need to memorize passwords, you can change them as often as you fancy.

ziddoap 2y ago
>_you_ can change them as often as _you_ fancy. This is all that matters, regardless of whether a password manager is used or not. Users should be able to change their own password (almost) whenever they want. But arbitrary forced password changes from the admin should not happen unless the account has indicators of being compromised (even if all of your users have a password manager).
- nashashmi 2y ago
  I run into issues where the password manager doesn’t update. And I also now have 4 managers (lastpass; chrome; edge; icloud keys) because of multiple platforms over the years.
  - nine_k 2y ago
    I bit the bullet and moved everything to BitWarden. (The idea is that I could self-host it if the service becomes problematic.)

Workaccount2 2y ago

Our organization contracts out our IT, I can cannot stress enough how bad/lazy their cyber security guys are. It feels like the owner told his directionless son "Hey boy, if you manage to pass this cert class I'll make you head of cyber security!" Every few months we need to change our password. It cannot be a previously used password. It needs uppercase, lowercase, number, special character and minimum 12 characters. We have 2FA that is easily bypassed by going offline then back online once through login. We have 4 different active security suites running on our machines, and mandatory biweekly virus scans, at 10am (which cannot be changed). Every standard 16GB machine runs on it's knees all day long. But at least you can skip 2fa by turning off wifi real fast.

formerly_proven 2y ago
We made IT security a checklist compliance exercise and call it cybersecurity, and then we are shocked and surprised the main deliverable turns out to be checked checklists, not security.
- nonrandomstring 2y ago
  Don't stop there. You can make some even greater efficiencies. By having cyber-insurance you can do nothing and just have someone pay you out money when you fuck up. There's no end of ways security theatre and half-arsed "compliance" can help lower standards,
  - quacksilver 2y ago
    To be fair, if using insurance and risking being hacked anyway has a higher expected net payoff than implementing a given set of security measures, then you may be financially incentivized (or legally beholden to your shareholders) to take the risk, get hacked and pay any fines if it gets discovered. The security literature refers to it as "risk transference". Chances are your company ultimately exists to optimize for shareholder value
SketchySeaBeast 2y ago
I personally can't imagine trying to be a cybersecurity person. I'd be going out of my mind, concerned with all the things I can't keep up with. As a full stack dev, if I don't know what's new in React 19 it doesn't really hurt anybody, but if the cybersecurity people aren't up to date, that could very well be the end of the company. Either you're hot shit, just think you're hot shit, or you simply don't care, and that blend really scares me.

nashashmi 2y ago

I think when compared with a breach in 2FA, changing your password is a good counter. But I agree that in the case of failed 2FA (total failure), an alert should be sent to the user: "password used to access account; but second factor authentication was unsuccessful; change password if this was not you".

deleted 2y ago

[deleted]

brookst 2y ago

For places that enforce password changes, I can always tell how old my account is by (password change frequency) * (counter I put at end of password). My actual password choices are secure, memorable, and available even if I lose my phone or password manager. The counter is just an annoyance.

Goronmon 2y ago
For places that enforce password changes, I can always tell how old my account is by (password change frequency) * (counter I put at end of password). I can't because there is generally a limit to how many passwords it checks for previous use. So you can usually just start back at "1" for the increment after you hit "0".
- SAI_Peregrinus 2y ago
  I just use a strong PascalCase passphrase (as strong as feasible if they have a stupidly short limit) and the year & month of the last password change. Something like `PascalCasePassphraseButRandomlyGeneratedProperly2024-12` for one this month. Fits many composition rules (those are also recommended against) by having uppercase, lowercase, numbers, and punctuation. Doesn't repeat previous passwords. And the entropy of the actual 7-word diceware passphrase is about 90 bits, which is pretty decent.

quacksilver 2y ago

It used to be a good idea with things like AD, where pass-the-hash attacks worked and hashes would be static until changed, and in environments where hashes were relatively exposed for cracking and used weak hashes. Hopefully that is not the case now though, and I am surprised the advice has persisted... (though outdated gov standards probably played a part until recently)