Hacker News Reader

Comment by beedogs | Hacker News Reader

Forced periodic password change has got to be near the top of the list in terms of the dumbest things the IT world has blindly gone along with in the past decade. Glad NIST finally agrees with me on this.

View on HN

"Forced periodic password change has got to be near the top of the list in terms of the dumbest things"

Totally agree. I often encounter problems that go like this:

UltraSecureSystem: Create a secure password.

Me: "#@(J #!_04';/1~"

UltraSecureSystem: Password must be at least 8 characters long, can't include special characters and consists of at least one upper case letter, one lower case letter and one number.

Me: "Password0"

UltraSecureSystem: Congratulations, your ultra secure password created!

UltraSecureSystem: Your password has expired, create a new ultra secure password.

Me: "Password1"

UltraSecureSystem: Congratulations, your totally new and totally secure password created!

Tip: Some systems only remember your last 3 or 10 passwords, so it's worth rotating up to Password9 and then coming back to Password0. Tip given by my boss who received it by his chain of command of old people who couldn't remember the password change. True story.

Which is why in a lot of corporate systems, the password history is set to 13 last passwords. a) it prevents a 0-9 rotation, and b) it also prevents people rolling passwords based on month name or number.

Why is why password rolling is then based on an alphabetical roll, or pure numerical increment, or month and year. No real entropy gain!

August2016 September2016 October2016 etc.

pls don't hack me

I didn't say it was a good system ;)

As the implementer, I've argued many times about it, but the ITSec bods always think they know best.

That's what hexadecimal digits are for :)

Do they put a maximum on how many times you can change your password? If not, you could just cycle through 13 passwords in 5 minutes, then switch back to your original password.

I wrote a PowerShell script that does exactly this for Windows Domains.

http://pastebin.com/raw/ytwy0nCB

In AD there is a MinPasswordAge policy that is typically set to 1 day to thwart exactly this type of work-around.

I'm not sure that it makes much difference whether I reset to 0 or keep going through 10 and up. My biggest frustration is that every password change I'll mistype my closing digit for about a week before muscle memory gets the new one right,

(Although this time I had a unique experience where I adjusted quite quickly from "2" to "3" and because I was still thinking "don't forget to incrememnt" ended up typing "4". Uggggghhhhhhhhhh)

... and then you get locked out because your domain controller (or whatever) is set up to ban you after ~3 invalid login attempts in a row. Happened to me once.

Fun fact. In my organization we are required to change password each three months, so now im on ...24 and i can calculate from that how long i been working here :)

Instead of numbers, you can also use spring-summer-autumn-winter.

This is exactly what I do as well. Well, when I'm not getting the AD admins to let me reset my password directly from the admin console.

This is what I used to do before I started using a password manager. Now I just change my password to a new, randomly generated one every month while my master password stays the same.

Sure, but this method doesn't work when I need to login to my corporate PC at work.

It does for me. KeePass on my phone + InputStick. I've even got a macro set up to enter all the necessary keystrokes so I can login with one tap. (Ctrl+Alt+Del -> Enter Password -> Enter)

Thank you for introducing me to InputStick!

You're welcome. I discovered it myself only around 6 months ago, and so far I've found it to be very useful.

Their website lists a lot of different potential applications, but I use it almost exclusively for entering passwords from KeePass. In addition to allowing password entry on the computer's lock screen, it also saves me the trouble of having to read and retype passwords manually on computers that don't have KeePass installed, and avoids exposing my entire password database to the computer it's plugged into (as would be the case if I used portable KeePass on a USB memory stick).

I think that's unfair! It makes sense on first glance, right? People can't steal your password if it changes all the time.

I personally find it unintuitive to think that people would give up on the "memorization" part if it became "too hard". It's true, and we know this from study, but to say it's "dumb" is unfair.

The only password I need to write on a paper near my computer is of a client that require periodic change over his Vpnssl every 1 month. When connecting to it I must type it 3 different time in a context where password manager don't work.

After a year of trying to keep track of the changes via a secured method (and at least 12 call to their IT so they reset the password without any identity check on their part) I finally resigned and write it down on paper and write the new one every time they ask me to change.

Bonus fun fact : Theses idiots also truncated password at 8 characters but truncated in different manners on the 3 login steps required so it's only after 4-5 failed attempts at a secured corectbatterystapplehorse that I understood that weak password was mandatory by their rules...

PS: And of cour rotation between Passwd1 passwd2 passwd3 passwd4 (then back to 1) was perfectly accepted and considered as safe

I ended up memorizing my home's old WEP key simply because, since I was the "tech guy" in the family, everyone would ask me whenever they needed to add a device (never mind that I was mostly just going to the password booklet and reading it out). Eventually I just stopped needing to look it up. I've since used it in some places, blended with a mnemonic for the specific site. 10 hex characters plus a string might not be the highest-security thing, but at least it's not going to fall to anything less than brute-force.

Reply on news.ycombinator.com