Password expiration is dead, long live passwords

Shifting from passwords to more secure systems such as MFA ignores the elephant in the room about passwords that no-one wants to acknowledge: People share passwords.

A simple example is this: A couple do online grocery shopping every week or so, depending who has time to do it, one them will log into the 'account' and build the basket. Maybe the other will then amend the basket a few hours later before the cut off time. With enforced MFA, this is not possible.

There will always be a small percentage of situations where '1 person = 1 account' will never be true. Until providers add the concept of multi-logins to the same 'account' on their systems you can't wholesale move to stronger security methods.

I have the same issue with all these 'smart home' products that need an app installed onto a phone or tablet. A lot of them are bound to a single account, which means if other people in the household also want to have the app, you have to share your account details. if it's a Google or Amazon product, that means you are sharing account details of an account that you really shouldn't be.

The other part of this story I did not see mentioned is that I suspect that password expiration also makes organizations more vulnerable to social engineering hacks because legitimate users (I have done this) become locked out due to poorly managed password expiration, then have to call in to restore access. The use of insecure identity and authentication mechanisms like student IDs and security questions is a recipe for abuse.

Good riddance to password expiration.

"Periodic password expiration is a defense only against the probability that a password (or hash) will be stolen during its validity interval and will be used by an unauthorized entity. If a password is never stolen, there’s no need to expire it. And if you have evidence that a password has been stolen, you would presumably act immediately rather than wait for expiration to fix the problem."

Full post: https://blogs.technet.microsoft.com/secguide/2019/05/23/secu...

Recent, frustrating example: My (business) bank uses FISERV software, and their software expires passwords every 90 days. Their software can notify you about a million combinations of account activities and statuses, except this one. It takes 3 values to login to the account (company ID, username, password). When logging in via mobile app, it never tells you that your password has expired, so I end up trying a few times before I remember it might be an expired password.

Login via web browser, and sure enough it'll tell me my password expired and it's time to change it. They also occasionally enforce 2FA. Passwords are also how you connect things like Quickbooks.

When I called the bank to find out how to get notifications that a password has expired, they said there was no way. "When you change your password, set a calendar event for 60 days ahead..." they told me.

Another worst offender are security questions to unlock accounts. Answers to these questions are usually visible to customer service reps and similar set of questions are asked among different services. This is scary.

It's dangerous as having password stored in plain text as answers to the security questions can potentially unlock many other accounts.

I highly suggest everyone answers each of them with a unique answer.

It's going to take literally an entire human generation or more for the terrible password rules of the 2000s to disappear. Forced password changes and the myriad irrational rules about acceptable password contents have been drilled into the heads of every sysadmin and security engineer for the past two decades. They were never evidence-based rules, they were just learned behaviors.

Not sure expiration is the worst problem with passwords. In no particular order,

* Most are easy to remember (most of us don't use LastPass etc)

* They authenticate the user but not the service!

* They're leaky (the system tells you when you have the wrong one, facilitating several kinds of attacks)

* People leave them lying around all the time

* Changing one almost always involves using the old one (instead of starting over from first principles)

Don't get me started on usernames! If you have a large hashed password, then the username becomes irrelevant (except as a way of leaking information).

Here's a modest proposal:

* Insist on large hashed passwords (256bit or better).

* Forget about usernames. The password becomes an 'account key' and is all you need

* Allow delegation: from one account to another; enable/disable features even for the 'main' account; give away authority for delegation at the feature level

* Never deny login for any reason, because that leaks security info (e.g. 'that password is illegal' is information). Just trust every legal password, and if it doesn't exist in the system then create a new default account

That's exciting news, though it will take a couple of years until it trickles down to financial institutions. My bank forces me to change passwords every 3 months, and of course they also disable pasting for added security.

We also have a local utility that sends you a 5 letter password upon account creation through email, and that's your password. If you try to change it, they'll send you another 5 letter one.

I've always wondered how many engineer hours have been lost on the phone with helpdesks sorting out expired passwords.

Ah good stuff. Password expiration is a pain, but it's worse for Windows login because I can't even open Keepass until I get in!

When forced to do this I will use something like "B@s3P@ssw0rd1" then "B@s3P@ssw0rd2", "B@s3P@ssw0rd3" etc.

I still expire passwords on a yearly basis for the sole reason that users have complained to me that it stops them from using the password they use for everything else.

I'm not entirely sure that I'd agree with this mentality. Sure, at a glance it sounds good. If the password has been safeguarded, there's really not much reason to force expiration. However, wouldn't the age of the password reduce the security of it by default? The longer a password exists for, the more likely it is that it can be cracked, discovered by a misplaced Post-It note, or compromised by some other unknown security issue. With all the other security and privacy concerns in this thought process seems contrary.

So does this mean they also changed the guidelines in the SSPA? This is their security framework / certification for vendors doing business with Microsoft.

Also NIST dropped password complexity requirements. The only hard requirement is it must be 8 characters or more. New guidelines is to let users choose their own level of complexity and encourage them to make longer passwords that they can actually remember.

We would like to follow NIST 800-53, but too many customers (like Microsoft) still do not allow for the 2016 NIST changes.

I wish every compnay that does this will stop too. It's so frustrating and annoying having to change my passwords so regularly.

The internal time management software we use at work, which I only access every few weeks always forces me to set a new password. So every time I come to log on, my password has expired. What makes it worse is that this password is connected to other work services but they're not synchronised so when I change one, the other doesn't always change for a couple of days. Sometimes, the only way to log in to my machine is to disconnect the ethernet and make sure the wifi is off. And I have to keep a document on my phone with every variation of my passwords in the last few months and even then, if I am on holiday for a while and come back to work, none of them work.

I think there is a class of companies and services (Excluding Microsoft) who just need to leave the business of user security to the user and stop trying to build walls around an enclosure that no one cares about in the first place.

Not only are expirations pointless but it’s ridiculous that a 24-hour expiration system is often paired with a “Monday-Friday, 9-4 Eastern” kind of phone call.

I once had an investment account lock out at the start of a weekend and I couldn’t log into the damn thing for days simply because their robot shut it off and only a working human would turn it on.

Password expiration made average users need to remember more password combinations and resulted in them using the same password for each website they use. This is a serious issue, especially when sites the size of facebook are accidentally logging plaintext passwords on their servers.

Password managers are claimed to be the solution but we just aren't seeing average users jumping on board - probably due to the added complexity.

So what's the solution? How about websites begin client side hashing as well as using SSL and hashing server side. Then every users 'password' becomes unique by having a specific salt per website. This would hugely improve the current scenario in that when a site is hacked, attackers can try every users details on a range of other sites gaining access due to password re-use.

This has known for years now, but unfortunately, takes a long time to change.

The other thing what I just read recently and mentioned in this article is about storing secrets in environment variables. That's not good either because every running code and subprocess can read it...

The first time I came across password expiration was on a login I was given to someone else's windows server. I only needed to log in once a month or less and every single time I got the message, your password has expired and must be changed, it was laughably pathetic how they ever expected people to remember a new hard to guess password every month. So of course I did what others have said and tagged on a 1 each time to the end.

The article recommends LastPass but ironically LastPass still asks you to change the master passphrase every 180 days. I've complained about this a long time ago and they didn't seem to take my request seriously despite my sending them links to the NIST recommendations.

These “baseline rules” come from NIST SP 800-63B, Appendix A, which is a surprisingly digestible document: https://pages.nist.gov/800-63-3/sp800-63b.html#appA

I sent in the NIST announcement to enterprise sysadmins last year as an opportunity for improvement. They closed as wontfix. I dont blame them for moving slow. This hopefully will move them a little.

They have a guy whose job is basically to deal with unlocks after password changes.

Great but this still exists in outlook online, Amazon, and probably other places. If Microsoft is really serious about this, they would get rid of password expiration everywhere. It actually leads to less secure passwords as combined with their shitty ui and multiple password change systems, each with its own password rules (another stupidity that needs to die), it leads one to ignore the password generator and manager and just use a simple password that can be remembered and changed by one number when it expires. This way I'm not updating multiple clients constantly and can actually change the password on the first try. I'm glad such insecure and stupid practices are finally going away.

When signing into Office 365's admin portal for the first time, "Set passwords to never expire" is actually the first and only wizard-type suggestion that's presented as a best practice to get out of the way.

It's a nice reminder and the option is already pre-selected so you just have to click Save. I've gotten into the habit of doing this now even before configuring domains, users, etc.

The next logical step of course is to enable/enforce MFA for all users as a thorough auth policy.

Surprisingly, the most important organizations (like banks and government departments who have critical data) who need to ditch this practice, embrace it like the holy grail.

I'm in the camp where I don't want systems to do fancy validations on passwords but I do think expiring passwords is not a bad idea. The thing is that many times your password can get stolen and you might not even know it. I've seen people writing down their passwords on sticky notes, saving in Chrome, get stolen by fake apps etc. At least for Windows, expiring passwords wasn't huge pain because of integrated authentication everywhere.

We’re required to have password expiration by law in the public sector of Denmark. So I’m sure we’ll continue to have it for at least some years to come.

I must admit I never really understood the function of it. Obviously lifetime access is more damaging than 3 months access, but the truly devastating thing is the unauthorised access itself not the length of it. Also the policy results in really bad practices like people using summer2019 as their password or writing their current password down on post it’s. We tried blocking stuff like summer2019, but people get really creative. People also forget to renew their passwords, costing hundred of hours in the process.

We have 2FA now, which will soon be required by our adoption of the GDPR, but you have to wonder why we didn’t get that decades ago instead of the password expiration.

This should be coupled with the usage of multi-factor authentication and making users aware of when and where their accounts have been used.

In organizations, one issue is users knowingly sharing their accounts with fellow workers. It's not because they don't know better, but because this is more convenient. Forced password changes (with limits on password re-use) can limit the risks caused by this.

Can we stop linking to Oath family websites until they sort out the cookie policy UI?

There's so many better ways to identify an account than a string of characters. Just like we shouldn't be using an integer for Credit card numbers or Social Security (or Social Insurance for the Cdn's)

Can't we say good riddance to all passwords yet? I yearn for the day where I can log-in everywhere using public key cryptography.

At work a client pushed new security protocols on us and of course management allowed it. Now I get to update my password every 30 days.

Yes! I actually got into an argument with our IT team about this.

The only thing it prevents is the continuation of a password-based breach.

A benefit of enforced password changes is that you can use it to practice those keys that you are weakest at touch typing.

For those of us who have to remain PCI compliant the tyranny of password expiration will remain. 90 days unless I am mistaken?

Nice. So how many years will it take until someone realizes that asking users to include specific character classes actually decreases password security too?

What I mean is that if you ask your users for a password that includes lower-case letters, upper-case letters, numbers and special characters you will probably end up with something like 'Password123!'.

Instead, we could ask our users for reasonably complex passwords without requiring to include specific characters sets. Yes, I am talking about

https://www.xkcd.com/936/

With MFA it reduces the risk of losing password. Without MFA - what if you don't know your password is stolen?

I am not convinced and I'll continue to rotate my passwords on a periodical basis.

MFA is annoying too.

I’d like to know why info sec has traditionally been anti-science to begin with, and if they are going to adopt data backed approaches to backup their theories, what other old wives tales will they’ll be addressing next?

If your want to version secrets, environment variables and code together... you can, just make sure to use a proper solution such as http://configrd.io.