6 ms·

Does anyone not add the year & month of the last password change to the end of their password? E.g. PascalCasePassphraseGoesHere2025-06, then at the next requir

Does anyone not add the year & month of the last password change to the end of their password? E.g. PascalCasePassphraseGoesHere2025-06, then at the next required change in (for example) 6 months: PascalCasePassphraseGoesHere2026-01. It almost certainly fits the inane "letter, number, and special character" requirements they probably have, complies with "different from your last X passwords", and is easy to keep track of the change interval. It also adds no security whatsoever! A user could almost certainly get away with Password2025-06, etc.

repeekad 1y ago
I’ve personally experienced the password change require that “more than X characters be different than the old password”
- valleyer 1y ago
  Um, that's a really bad sign...
  - klysm 1y ago
    To elaborate for the uninitiated, that means they are storing it in plaintext somewhere.
    - mx_03 1y ago
      Is there any way to check that with non-plain-text password?
      - jchw 1y ago
        Actually it can be trivial as long as you can require the user to re-type the current password when entering a new password; check hash first, then check edit distance with the entered "current password" (and, of course, promptly throw it away once you know the edit distance.)
        nullify88 1y ago
        Ohh. I guess that's what Windows does when a user wants to change their own password in the domain.
        mrspuratic 1y ago
        It does more than that, it keeps a hashed password history (which used to be in the user attr ntPasswdHistory, but is now "somewhere secret" afaik) according to the value of ms-DS-Password-History-Length attribute. OpenLDAP keeps these (ppolicy overlay) in the user object. So, it can hash any proposed password and compare the history to make it's not been seen $recently (as an exact match, since it's comparing hashes). It could also perform some minor permutations of any new password, and do the same history check to make sure you're not just changing the first or last character or digit. I don't know if it does this, but it could.
    - _moof 1y ago
      Unless they ask you for your current password as part of the password change flow.
    - mattmanser 1y ago
      No it doesn't. Shows you how complicated all this is and how the un-initiated (including me) should learn to not give their two cents. When you do the password change it asks you for the old one, that's how it knows. So it asks for old + new, checks old is correct against the hash, and then compares old + new likeness. So it all happens in memory.
  - rocqua 1y ago
    No, you can do it safely. The idea is to have the password renewal process also ask for the previous password. This means the password changing method doesn't need to store a plaintext password, but still has access to the old plaintext password when changing. It's still not a great idea, but that's because nagging your users will see them choose worse passwords.
    - _dark_matter_ 1y ago
      Oh so trivially bypassable by changing your password twice.
  - dspillett 1y ago
    Not if the check is done client-side, so the plain password never leaves you local domain. Of course the check being done client-side means that it isn't difficult to skip if you are inclined to make a smidgin of effort.
    - thih9 1y ago
      It can be done server side too, the old password can be sent along the new one and the server can verify it.
      - dspillett 1y ago
        Yes, what I meant to say that it doesn't even have to be done server-side, so the fact it happens doesn't imply the server ever sees the old password beyond it's initial setting.
- deleted 1y ago
  [deleted]
deathanatos 1y ago
I just let the keyring roll a completely new password. For some reason, all of my employers do require this insanity, but not on the one password I have to actually type.
- bisby 1y ago
  I once had an employer that required us to use passworded SSH, and disallowed SSH keys, because they couldn't enforce that the SSH keys were passphrase protected, so just turned that option off. They said it was a PCI requirement, or something.
  - yardstick 1y ago
    PCI requires multi-factor auth these days, so you’ll likely find now the ssh password will be your password plus a OTP at the end.
    - notpushkin 1y ago
      Isn’t there a way to ask for OTP after initiating the SSH session?
      - mrspuratic 1y ago
        Yes, via PAM, and this works fine with OpenSSH. But the couple of OTP implementations I've used are the same, you can either provide password and PIN or passwordPIN. In the end they get concatenated, passed to the next layer, and taken apart for checks. This lets it work with brain-dead http basic auth too, if you're unlucky enough to have to use that...
        notpushkin 1y ago
        Yeah, I’ve seen it in a couple places, too. (Once I’ve had to write my own wrapper for openfortivpn that did exactly that!)
      - odo1242 1y ago
pcardoso 1y ago
I once wrote a script to change my password randomly X times and then back to my original password. Worked like a charm.
- claudex 1y ago
  There are policies to prevent changing the password more than once a day to prevent that. I've encountered it in several places
  - thih9 1y ago
    Fascinating. In other words: In order to force the user to change their password more frequently (long term), the user is prevented from changing their password too frequently (short term). I wonder whether the person who added that is actually confident that the benefits outweigh the drawbacks or is that a case of tunnel vision.
  - eqvinox 1y ago
    There are also systems that keep a history of old passwords just to prevent you from reusing one.
    - jandrese 1y ago
      I like the ones that not only keep a history of your old passwords but will reject any password that is similar to any of your 30 previous passwords, which means they're storing either a plaintext or reversibly encrypted list of every password somewhere on the system. Talk about a goldmine for the hacker that dumps that database.
      - rightbyte 1y ago
        Ye. If the insane password gatekeeper shenanigans doesn't make you input your old password together with the new, you know they store your passwords.
      - Rexxar 1y ago
kelnos 1y ago
When I first set up an account at a new org or whatever, I don't think about the possibility of rotation later, but once I get my first "your password has expired and needs to be reset" message, I just add a counter to the end of the password that I increment each time I'm required to change it. Successive passwords have no less entropy than the original password, anyway. Fortunately, I haven't encountered a system that does a similarity check when changing the password.
- deleted 1y ago
  [deleted]

repeekad 1y ago

I’ve personally experienced the password change require that “more than X characters be different than the old password”

valleyer 1y ago
Um, that's a really bad sign...
- klysm 1y ago
  To elaborate for the uninitiated, that means they are storing it in plaintext somewhere.
  - mx_03 1y ago
    Is there any way to check that with non-plain-text password?
    - jchw 1y ago
      Actually it can be trivial as long as you can require the user to re-type the current password when entering a new password; check hash first, then check edit distance with the entered "current password" (and, of course, promptly throw it away once you know the edit distance.)
      - nullify88 1y ago
        Ohh. I guess that's what Windows does when a user wants to change their own password in the domain.
        mrspuratic 1y ago
        It does more than that, it keeps a hashed password history (which used to be in the user attr ntPasswdHistory, but is now "somewhere secret" afaik) according to the value of ms-DS-Password-History-Length attribute. OpenLDAP keeps these (ppolicy overlay) in the user object. So, it can hash any proposed password and compare the history to make it's not been seen $recently (as an exact match, since it's comparing hashes). It could also perform some minor permutations of any new password, and do the same history check to make sure you're not just changing the first or last character or digit. I don't know if it does this, but it could.
  - _moof 1y ago
    Unless they ask you for your current password as part of the password change flow.
  - mattmanser 1y ago
    No it doesn't. Shows you how complicated all this is and how the un-initiated (including me) should learn to not give their two cents. When you do the password change it asks you for the old one, that's how it knows. So it asks for old + new, checks old is correct against the hash, and then compares old + new likeness. So it all happens in memory.
- rocqua 1y ago
  No, you can do it safely. The idea is to have the password renewal process also ask for the previous password. This means the password changing method doesn't need to store a plaintext password, but still has access to the old plaintext password when changing. It's still not a great idea, but that's because nagging your users will see them choose worse passwords.
  - _dark_matter_ 1y ago
    Oh so trivially bypassable by changing your password twice.
- dspillett 1y ago
  Not if the check is done client-side, so the plain password never leaves you local domain. Of course the check being done client-side means that it isn't difficult to skip if you are inclined to make a smidgin of effort.
  - thih9 1y ago
    It can be done server side too, the old password can be sent along the new one and the server can verify it.
    - dspillett 1y ago
      Yes, what I meant to say that it doesn't even have to be done server-side, so the fact it happens doesn't imply the server ever sees the old password beyond it's initial setting.
deleted 1y ago
[deleted]

deathanatos 1y ago

I just let the keyring roll a completely new password. For some reason, all of my employers do require this insanity, but not on the one password I have to actually type.

bisby 1y ago
I once had an employer that required us to use passworded SSH, and disallowed SSH keys, because they couldn't enforce that the SSH keys were passphrase protected, so just turned that option off. They said it was a PCI requirement, or something.
- yardstick 1y ago
  PCI requires multi-factor auth these days, so you’ll likely find now the ssh password will be your password plus a OTP at the end.
  - notpushkin 1y ago
    Isn’t there a way to ask for OTP after initiating the SSH session?
    - mrspuratic 1y ago
      Yes, via PAM, and this works fine with OpenSSH. But the couple of OTP implementations I've used are the same, you can either provide password and PIN or passwordPIN. In the end they get concatenated, passed to the next layer, and taken apart for checks. This lets it work with brain-dead http basic auth too, if you're unlucky enough to have to use that...
      - notpushkin 1y ago
        Yeah, I’ve seen it in a couple places, too. (Once I’ve had to write my own wrapper for openfortivpn that did exactly that!)
    - odo1242 1y ago

pcardoso 1y ago

I once wrote a script to change my password randomly X times and then back to my original password. Worked like a charm.

claudex 1y ago
There are policies to prevent changing the password more than once a day to prevent that. I've encountered it in several places
- thih9 1y ago
  Fascinating. In other words: In order to force the user to change their password more frequently (long term), the user is prevented from changing their password too frequently (short term). I wonder whether the person who added that is actually confident that the benefits outweigh the drawbacks or is that a case of tunnel vision.
- eqvinox 1y ago
  There are also systems that keep a history of old passwords just to prevent you from reusing one.
  - jandrese 1y ago
    I like the ones that not only keep a history of your old passwords but will reject any password that is similar to any of your 30 previous passwords, which means they're storing either a plaintext or reversibly encrypted list of every password somewhere on the system. Talk about a goldmine for the hacker that dumps that database.
    - rightbyte 1y ago
      Ye. If the insane password gatekeeper shenanigans doesn't make you input your old password together with the new, you know they store your passwords.
    - Rexxar 1y ago

kelnos 1y ago

When I first set up an account at a new org or whatever, I don't think about the possibility of rotation later, but once I get my first "your password has expired and needs to be reset" message, I just add a counter to the end of the password that I increment each time I'm required to change it. Successive passwords have no less entropy than the original password, anyway. Fortunately, I haven't encountered a system that does a similarity check when changing the password.

deleted 1y ago
[deleted]