I never understood thecidea of having to change my password periodically. The password was good last month, why isn't it good now?
edit: or, in particularly terrible systems, if plaintext passwords were leaked.
Of course, that's only useful if it doesn't affect any other password security concerns, and it turns out that users who are forced to change their passwords frequently pick worse passwords, which is a bigger problem than the scenario this was supposed to protect against.
Pity so few systems support this.
The cost of maintaining a sufficiently real-looking system is likely to be very high, with the very real risk that it won't fool an attacker.
I can vouch for this. My rotating password at work is _______1, followed by _______2, then _______3, and so on. If a year-old hash gets cracked, it won’t take a rocket scientist to know that the password right now is _______4.
That said, lastpass can work without any modifications to your local machine(i.e. it can work without any browser plugins even) tho it's not very fabulously integrated, it does work... Assuming of course they don't block access to the lastpass website and JS.
In all fairness, it's a fair assumption. There is an attack vector where one gets an old password from 8 years ago by whatever means... and it is still valid.
The execution was terrible though. People started forcing password change every month [which is overkill to stop an attack that has a multi year timespan] and it created a whole new set of disasters.
It happens, all of the time.
Many people use predictable rotations (incrementing number, date appended), so if you know one, you know them all.
Also if they've shared it once, why would they not share it again? Put another way: why is making them regularly reset their password going to make them suddenly follow security protocol, when it didn't the last n times they had to change their password?
If the office thinks it's okay to share their password it's also a symptom of several things:
* Lax security environment, with not enough emphasis on security training and importance.
* Poor senior management. There should be reprimands for violating security rules, as severe as losing your job for repeat offenders, and obviously IT can't do this on their own.
* Bad work environment provided by IT. Why are they sharing passwords to begin with? Maybe the environment is overly locked-down with too many restrictions, or maybe the collaboration tools are just bad or missing.
Fix those, the password sharing stops.
I agree that this approach is not very user-friendly.
Comparing old passwords without plaintext is really hard and at best inexact.
Storing them plaintext (or even reversibly encrypted) is completely stupid, of course.
Even if these technical problems could be solved, sequences like: November6, December7, January8 are not "similar" but easily predictable.
Even this sequence is probably not hard to figure out if you look at a keyboard: Secret1 Drvtry2 Ftbytu3
Deeper though, what security threat is this actually mitigating? Bad passwords caused by rotation requirements that are needed because of bad company policies, training and practices? Is there a security equivalent of "yak shaving"?
If only the hash and salted password is stored, as recommended, how would you know that "myOldPassword21" and "myOldPassword22" are similar ?
Can't have a new 'similar' algo for past pws, obviously.
For example, I could use: myoldpasswordA1 / myoldpasswordB2 / myoldpasswordC3. Probably obvious to a human my next one will be D4, but it is a comparable problem to "play every possible game of chess" for a computer to figure that out.
Combined with using a secure computationally-expensive password storage mechanism (eg: bcrypt or PBKDF2) and I'm not exaggerating: it now takes billions of years to verify a password change is allowed.
And this is trying to solve a compromised password problem. If there's no compromise, rotating passwords is pointless.
If the password IS compromised, rotating the password doesn't really fix it, it merely limits access -- maybe. It doesn't address the original means of the compromise (so you have to assume that's still there). It doesn't address backdoors installed. It doesn't address information stolen.
So this is a hell of a lot of work to accomplish .. basically nothing.
Two possible changes (forward/backwards) for two characters out of 15. 420 combinations. Not exactly billions.
Yes, but you can only cut down the sample space in this way because you can look at "myoldpasswordA1" and know that the 'A1' characters are the iterators. A computer doesn't know that.
Why does someone have an old password in the first place? You should be asking how it got compromised, who knew the credentials, if it was compromised while still active, and if so, how many backdoors were installed, what data/systems were compromised, and how do you prevent this from happening again.
None of the problems could have been avoided if only there was a better password iteration detection algorithm.
All true. Nevertheless, there are cases where someone gets a one-off copy of a password - perhaps overheard. If you force them to actively install a backdoor then you increase the costs of attacking greatly. It's not about perfect security, it's about the cost/benefit - a lot of crime is crime of opportunity, especially internal fraud.
I think that it's my fault, but I can't understand this sentence. Doesn't forcing someone to install a backdoor decrease security? The only reading that makes sense to me is "If you make it so that it's user action, rather than inaction, that results in the installation of a backdoor …"?
(For what it's worth, although I disagree with you, I respect your dedication to arguing this determinedly but civilly.)
>> comparable problem to "play every possible game of chess" for a computer to figure that out.
It would be a poorly programmed computer that didn't consider this possibility.
It does help to limit the scope of who has passwords. Certainly not a perfect solution, but it isn't completely ineffective either.
Only if the rotation isn't predictable. If I receive "password3" and it doesn't work and Joe who shared it with me isn't available, I probably wouldn't think twice about trying "password4".
I'm not supporting that position, just what I heard many years ago when talking with a security person.
Of course, the proper thing to do would be to deactivate the account when someone leaves the organization. But if the organization doesn't have it together enough to deactivate and reactivate accounts properly, they might rely on the time limit as a fallback. The reason your password isn't good now is that someone doesn't have the info they need to do their job (deactivating accounts) properly, is lazy, or is paranoid. In any case, it's a signal that the organization that's requiring you to change your password can't manage account deactivation.
It's also a similar rationale to password resets. The e-mail might end up in some leak somewhere (see WikiLeaks), but the link won't be valid anymore.
It doesn't stop all classes of security issues, but it does make the data time-sensitive. Think about all the account leaks that happen. The data is rarely current (usually a year+ old).
So the policy is ineffective.
For example, imagine if someone compromises one of your backups. Some hard drives were stolen from the office or something. In there you had your password written in a text file ( because you're that kind of person). The attacker still doesn't have access to your computer. But they do have access to your password from the time of backup.
A disgruntled employee remembers the password of a former coworker. At one point the password will change, so the window of opportunity is smaller.
It's not perfect, obviously, but in a lot of office environments passwords are easy to gleam.
Another argument for password rotation: it usually forces people to keep different passwords per service. Without rotation, people tend to use the same password for everything
There's a trade-off, but it doesn't accomplish nothing
I preach to them they should not have an $EVERYWHERE_ELSE password, and should definitely not use it at work. But they do anyways.