Hacker News Reader

Comment by kbart | Hacker News Reader

"Forced periodic password change has got to be near the top of the list in terms of the dumbest things"

Totally agree. I often encounter problems that go like this:

UltraSecureSystem: Create a secure password.

Me: "#@(J #!_04';/1~"

UltraSecureSystem: Password must be at least 8 characters long, can't include special characters and consists of at least one upper case letter, one lower case letter and one number.

Me: "Password0"

UltraSecureSystem: Congratulations, your ultra secure password created!

UltraSecureSystem: Your password has expired, create a new ultra secure password.

Me: "Password1"

UltraSecureSystem: Congratulations, your totally new and totally secure password created!

View on HN

Tip: Some systems only remember your last 3 or 10 passwords, so it's worth rotating up to Password9 and then coming back to Password0. Tip given by my boss who received it by his chain of command of old people who couldn't remember the password change. True story.

Which is why in a lot of corporate systems, the password history is set to 13 last passwords. a) it prevents a 0-9 rotation, and b) it also prevents people rolling passwords based on month name or number.

Why is why password rolling is then based on an alphabetical roll, or pure numerical increment, or month and year. No real entropy gain!

August2016 September2016 October2016 etc.

pls don't hack me

I didn't say it was a good system ;)

As the implementer, I've argued many times about it, but the ITSec bods always think they know best.

That's what hexadecimal digits are for :)

Do they put a maximum on how many times you can change your password? If not, you could just cycle through 13 passwords in 5 minutes, then switch back to your original password.

I wrote a PowerShell script that does exactly this for Windows Domains.

http://pastebin.com/raw/ytwy0nCB

In AD there is a MinPasswordAge policy that is typically set to 1 day to thwart exactly this type of work-around.

I'm not sure that it makes much difference whether I reset to 0 or keep going through 10 and up. My biggest frustration is that every password change I'll mistype my closing digit for about a week before muscle memory gets the new one right,

(Although this time I had a unique experience where I adjusted quite quickly from "2" to "3" and because I was still thinking "don't forget to incrememnt" ended up typing "4". Uggggghhhhhhhhhh)

... and then you get locked out because your domain controller (or whatever) is set up to ban you after ~3 invalid login attempts in a row. Happened to me once.

Fun fact. In my organization we are required to change password each three months, so now im on ...24 and i can calculate from that how long i been working here :)

Instead of numbers, you can also use spring-summer-autumn-winter.

This is what I used to do before I started using a password manager. Now I just change my password to a new, randomly generated one every month while my master password stays the same.

Sure, but this method doesn't work when I need to login to my corporate PC at work.

It does for me. KeePass on my phone + InputStick. I've even got a macro set up to enter all the necessary keystrokes so I can login with one tap. (Ctrl+Alt+Del -> Enter Password -> Enter)

Thank you for introducing me to InputStick!

You're welcome. I discovered it myself only around 6 months ago, and so far I've found it to be very useful.

Their website lists a lot of different potential applications, but I use it almost exclusively for entering passwords from KeePass. In addition to allowing password entry on the computer's lock screen, it also saves me the trouble of having to read and retype passwords manually on computers that don't have KeePass installed, and avoids exposing my entire password database to the computer it's plugged into (as would be the case if I used portable KeePass on a USB memory stick).

This is exactly what I do as well. Well, when I'm not getting the AD admins to let me reset my password directly from the admin console.

Reply on news.ycombinator.com