6 ms·

Given the time it's been since deprecated, I'm assuming most older versions of Windows since 2000 and Samba have long since supported more secure options... tho

by tracker1 10mo ago

Given the time it's been since deprecated, I'm assuming most older versions of Windows since 2000 and Samba have long since supported more secure options... though from some comments even the more secure options are relatively weak by today's standards as well. Aside: still hate working in orgs where you have a password reset multiple times a year... I tend to use some relatively long passphrases, if not the strongest possible... (ex: "ThisHasMyNewPassphrase%#23") I just need to be able to remember it through the first weekend each time I change without forgetting the phrase I used.

christkv 10mo ago
I mean this is what I use 1password for.
- SahAssar 10mo ago
  If it's the IT managed computer login then you couldn't use a password manager for it, right? I think this is more the realm of using windows hello or apple touchid (AFAIK no good, simple, standard built-in way exists for linux distros) to get the first OS login and then you can use your password manager when you are logged into the OS.
  - infogulch 10mo ago
    ok fine, two passwords then
  - slashdave 10mo ago
    Hardware MFA is available for logins, including Linux.
    - SahAssar 10mo ago
      What method/program are you talking about? Does it support FDE? Is it reasonably supported with the methods expected by end users (fingerprint, face, smartcard, etc.)? Everytime I've tried its been finicky and had to use non-standard tools to get it working.
      - KAMSPioneer 10mo ago
        I'm a different commenter but yeah, solutions exist. For example systemd-cryptenroll let's you use a FIDO token (or TPM or PKCS#11 smartcard) to unlock your encrypted disk and it's very easy to set up. Quite literally a single command. Windows Hello serves the same purpose for Windows, though I'm sure there are caveats/differences.
        SahAssar 10mo ago
        If it's a fido hardware token you still need to make sure you have a backup token. It's a lot simpler on windows/macos where you can use biometrics for the same purpose.
        slashdave 10mo ago
        You can setup multiple keys. It would be crazy not to include a simple ascii hash key in addition.
  - christkv 10mo ago
    I look it up on my phone 1password and type it in manually
- tracker1 10mo ago
  I tend to never use my password manager for my primary OS logins for desktops/laptops I physically access. Fortunately, I rarely have to keep more than 5 or so memorized at a time (including my password manager, Bitwarden/Vaultwarden).
WorldMaker 10mo ago
Depending on your organization, it can sometimes help to point the right compliance person to the latest NIST guidelines, specifically: https://pages.nist.gov/800-63-4/sp800-63b.html#passwordver https://pages.nist.gov/800-63-4/sp800-63b.html#passwordver > Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically. However, verifiers SHALL force a change if there is evidence that the authenticator has been compromised. One of the nice cases where it can be helpful that standards themselves, which you can point to, have said to stop doing that.
- thewebguyd 10mo ago
  Unfortunately, not all guidelines have caught up. PCI-DSS still requires password changes every 90 days for anything in scope (the cardholder data environment, anything that might even remotely touch payment card data).
  - fragmede 10mo ago
    Not with MFA. Not for a while now. And regardless, the word(s) you are looking for is "compensating control".
- tracker1 10mo ago
  Yeah, I've gotten headway in this in other places I've worked... heavy advocate for the only requirement being a minimum length with the recommendation to use a "phrase" as well as not requiring rotation in terms of less than a year at a time if at all... though not strictly matching NIST, some ops find a never require change hard to swallow. I wrote an authentication platform used by a few govt agencies. The irony is all my defaults match NIST guidelines (including haveibeenpwned lookup on password set/change), but needed to support the typical overrides for other hard requirements that tend to come from such agencies in practice.
  - thaumasiotes 10mo ago
    >> Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically. However, verifiers SHALL force a change if there is evidence that the authenticator has been compromised. > though not strictly matching NIST, some ops find a never require change hard to swallow. I think they're right about that. A scheduled change just represents the accumulating probability that there's been a compromise somewhere that didn't come to your attention. It seems like it would make more sense for a scheduled change to affect all passwords at once, though.
SoftTalker 10mo ago
Fine until you run into the filter that prevents the new password from having any of the same substrings longer than some limit compared to the old one.
- jandrese 10mo ago
  Which means that they're storing your password in plaintext somewhere.
  - mr_mitm 10mo ago
    No, because you have to submit the old one along with the new one.
- bongodongobob 10mo ago
  I don't think AD is capable of this natively.
jandrese 10mo ago
IMHO there are two requirements for a good password: 1. It must be hard for a computer to guess. 2. It must be easy for a human to remember. If you can not set a secure password and then remember it a week later it is a bad password. This is why I really hate overly strict password requirements that make it hard to remember. These cause people to write it down or do things that appease the password checker but don't make it harder to guess.
- slashdave 10mo ago
  3. Saved in a password manager
  - Delk 10mo ago
    That replaces number two and is the correct alternative in most cases. There are cases where a password manager may not solve the problem, though. It doesn't help if I forget my disk encryption or work AD password and I need to be able to login before I can get to the password manager in the first place. Enterprise IT is also where you find some of those frustrating password policies, such as long and complex passwords with mandated changes every month or two, and where you usually can't choose your management tools. Of course those particular passwords usually get typed so often that remembering them isn't much of a problem. And password managers work well for pretty much all secrets that aren't needed that often.
    - jandrese 10mo ago
      Until you need to login some place and don't have access to your password manager.
    - slashdave 10mo ago
      Yeah. I've been in the habit of keeping the (encrypted) password file in multiple places. So I can even get the password off my phone if I really need to. Although: be careful of cloud solutions

christkv 10mo ago

I mean this is what I use 1password for.

SahAssar 10mo ago
If it's the IT managed computer login then you couldn't use a password manager for it, right? I think this is more the realm of using windows hello or apple touchid (AFAIK no good, simple, standard built-in way exists for linux distros) to get the first OS login and then you can use your password manager when you are logged into the OS.
- infogulch 10mo ago
  ok fine, two passwords then
- slashdave 10mo ago
  Hardware MFA is available for logins, including Linux.
  - SahAssar 10mo ago
    What method/program are you talking about? Does it support FDE? Is it reasonably supported with the methods expected by end users (fingerprint, face, smartcard, etc.)? Everytime I've tried its been finicky and had to use non-standard tools to get it working.
    - KAMSPioneer 10mo ago
      I'm a different commenter but yeah, solutions exist. For example systemd-cryptenroll let's you use a FIDO token (or TPM or PKCS#11 smartcard) to unlock your encrypted disk and it's very easy to set up. Quite literally a single command. Windows Hello serves the same purpose for Windows, though I'm sure there are caveats/differences.
      - SahAssar 10mo ago
        If it's a fido hardware token you still need to make sure you have a backup token. It's a lot simpler on windows/macos where you can use biometrics for the same purpose.
        slashdave 10mo ago
        You can setup multiple keys. It would be crazy not to include a simple ascii hash key in addition.
- christkv 10mo ago
  I look it up on my phone 1password and type it in manually
tracker1 10mo ago
I tend to never use my password manager for my primary OS logins for desktops/laptops I physically access. Fortunately, I rarely have to keep more than 5 or so memorized at a time (including my password manager, Bitwarden/Vaultwarden).

WorldMaker 10mo ago

Depending on your organization, it can sometimes help to point the right compliance person to the latest NIST guidelines, specifically: https://pages.nist.gov/800-63-4/sp800-63b.html#passwordver https://pages.nist.gov/800-63-4/sp800-63b.html#passwordver > Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically. However, verifiers SHALL force a change if there is evidence that the authenticator has been compromised. One of the nice cases where it can be helpful that standards themselves, which you can point to, have said to stop doing that.

thewebguyd 10mo ago
Unfortunately, not all guidelines have caught up. PCI-DSS still requires password changes every 90 days for anything in scope (the cardholder data environment, anything that might even remotely touch payment card data).
- fragmede 10mo ago
  Not with MFA. Not for a while now. And regardless, the word(s) you are looking for is "compensating control".
tracker1 10mo ago
Yeah, I've gotten headway in this in other places I've worked... heavy advocate for the only requirement being a minimum length with the recommendation to use a "phrase" as well as not requiring rotation in terms of less than a year at a time if at all... though not strictly matching NIST, some ops find a never require change hard to swallow. I wrote an authentication platform used by a few govt agencies. The irony is all my defaults match NIST guidelines (including haveibeenpwned lookup on password set/change), but needed to support the typical overrides for other hard requirements that tend to come from such agencies in practice.
- thaumasiotes 10mo ago
  >> Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically. However, verifiers SHALL force a change if there is evidence that the authenticator has been compromised. > though not strictly matching NIST, some ops find a never require change hard to swallow. I think they're right about that. A scheduled change just represents the accumulating probability that there's been a compromise somewhere that didn't come to your attention. It seems like it would make more sense for a scheduled change to affect all passwords at once, though.

SoftTalker 10mo ago

Fine until you run into the filter that prevents the new password from having any of the same substrings longer than some limit compared to the old one.

jandrese 10mo ago
Which means that they're storing your password in plaintext somewhere.
- mr_mitm 10mo ago
  No, because you have to submit the old one along with the new one.
bongodongobob 10mo ago
I don't think AD is capable of this natively.

jandrese 10mo ago

IMHO there are two requirements for a good password: 1. It must be hard for a computer to guess. 2. It must be easy for a human to remember. If you can not set a secure password and then remember it a week later it is a bad password. This is why I really hate overly strict password requirements that make it hard to remember. These cause people to write it down or do things that appease the password checker but don't make it harder to guess.

slashdave 10mo ago
3. Saved in a password manager
- Delk 10mo ago
  That replaces number two and is the correct alternative in most cases. There are cases where a password manager may not solve the problem, though. It doesn't help if I forget my disk encryption or work AD password and I need to be able to login before I can get to the password manager in the first place. Enterprise IT is also where you find some of those frustrating password policies, such as long and complex passwords with mandated changes every month or two, and where you usually can't choose your management tools. Of course those particular passwords usually get typed so often that remembering them isn't much of a problem. And password managers work well for pretty much all secrets that aren't needed that often.
  - jandrese 10mo ago
    Until you need to login some place and don't have access to your password manager.
  - slashdave 10mo ago
    Yeah. I've been in the habit of keeping the (encrypted) password file in multiple places. So I can even get the password off my phone if I really need to. Although: be careful of cloud solutions