Hacker News Reader

Comment by davemp | Hacker News Reader

I've always wondered how many engineer hours have been lost on the phone with helpdesks sorting out expired passwords.

I did some lunch table math a few weeks ago. Assuming it takes on average 30 min for an employee to rotate a password (reboots, re-logins, etc.), assuming an average $50/hr across all employees, ~600k employees @ 4 changes per year (my current company policy is ever 80-ish days) = $60MM of human time spent per year making the company less secure.

It doesn’t take 30 minutes to change my password from ‘password5’ to ‘password6’ though.

If I don't restart my laptop after changing my password, I'm saving up for a whole load of shit. The proxy logins may, or may not, continue to work, but it's highly likely that at some point in the next few hours, Outlook is going to trigger 3 failed password checks and lock me out of my mailbox.

And that's assuming it expires when I'm in the office, whereas what seems to happen roughly half the time is it expires when I'm connected via the VPN.

You're assuming it works. Where I work we have an intranet-based web app that pushes the new password to all the various corporate systems. We're forced to choose a new password every 90 days. I'd say 1 time out of 3 something doesn't work, and I have to open a support ticket. While I'm waiting for support, I'm not getting emails, or can't log in to some systems, etc. Multiply that by hundreds of users at my company.

Twice, support resolved the issue by resetting my password and telling me the new one... which is my last name plus 4 digits. Then I can live with a very insecure password for 90 days, or try the reset app roulette again.

It's an insane amount. I've worked on writing helpdesk software for almost a decade now, and from time to time we are asked by our customers to run some analysis on their data; password resets are usually from 25% to 50% of the total requests to the system.

I work in the identity management space of a household name financial institution. We have varying levels of outages, but the top priority one is if people are unable to reset passwords through our UI. It's an absolute nightmare.

The real problem? People introduce password expiration to improve security, but the means of producing a new unexpired password after being locked out is less secure than the password itself creating a net loss in security.

How did this idea of expiring passwords arise in the first place? Misguided intuition or did the infosec people back then just get it wrong?

I don't know the origin story but (U.S.) National Institute of Standards and Technology (NIST) recommending password expirations from 2003 until 2016 played a part in propagating them. But I think that recommendation was largely based on was already fairly common, I think Microsoft Windows and Active Directory accounts expired by default well before 2003 (at least Windows NT and its successors).

It's existed in some form since at least the 1990s, likely through institutional or government practice.

A (possible) example from a 1997 Sybase manual: https://books.google.com/books?id=GzGuPO5fKOEC&q="password+e...

I just checked Simpson & Garfinkel's PUIS, which does mention forced changes, but not scheduled expiry. Also 1997.

(Google Book Search is badly polluted by mis-dated publications: http://www.google.com/search?q="password+expiration"&lr=lang... )

Ngram plot: https://books.google.com/ngrams/graph?content=password+expir...

The man's name is Simson Garfinkel — no "p" and no "&". (Your brain is probably confusing him with Simon & Garfunkel.)

Spafford and Garfinkel was what I'd meant to write.

Unreliable tablet input compounding even less reliable short-term working memory.

http://shop.oreilly.com/product/9781565921481.do

My favorite one was when I supported a customer who expired our passwords every 60 days, and resetting it involved calling Sweden (from the US) between roughly 10:30pm and 7am Pacific. Needless to say, of the 40 or so people who should have been doing this, few of them were.

And that was just one of a dozen or two customers with varied policies requiring we turn over SSNs, carry SecurID tokens, install various soft tokens on our laptops, roll passwords every so often, go through various and sundry jump hosts, etc......

Reply on news.ycombinator.com