Hacker News Reader

Comment by robbyking | Hacker News Reader

> These policies drive users to very predictable passwords

I used to do a lot of contract work for the Clarke County School District in Athens, GA. For "security" reasons they weren't able to create domain accounts for people who weren't full time employees, so I'd often have to track down the IT manager to gain access to servers I was working on.

He eventually got sick of having to drop what he was doing a dozen times a day, so one day he just gave me his password: a dictionary word followed by the number 23. Eventually the password failed, and he gave me his new password: that same dictionary word followed by a 24.

Fast forward a few years and I'm back installing some updates, and before I get to work he hands me a slip of paper, on which he had written Dictionaryword29.

View on HN

> a dictionary word followed by the number 23. Eventually the password failed, and he gave me his new password: that same dictionary word followed by a 24.

In a similar vein, over the past few years whenever I've got in a discussion with IT people who defend mandatory password change policies, I ask them to give me the last password they were using before changing it. No one has ever taken me up on that.

Most of the people I know use some kind password they can derive if they forget it. Like their password for Company A will be the city the company was founded, city the founder was born, and the month/day it was founded. The ones who have to change it because of policy pick something iterative, like the first line of a song, then the second, etc.

Most of the people you know are well outside the normal then.

In my experience the average password consists of 1-3 words with some meaning to the user, sometimes either in 1337speak or followed by numbers/symbols if the password policy requires them.

I'm with you on this. I know very few people who generate passwords like that and most people I know use some simple "special word with special number" pattern. Often it's kids names, a random word they picked as a password years ago and have been reusing, and some part of their pin number.

In the past, I used a grid of random characters (a tabula recta) that I keep in my wallet, plus an algorithm for pulling passwords out of it. This system broke down when I was forced to change passwords on various sites.

I'm relentlessly difficult. So at the last job where I had mandatory password change policies I could have told you my previous passwords† and they were all just random gibberish. I think I had to change them every 45 days, and I had a total of six passwords, although only three of them had to be changed every 45 days.

However, I would also not defend mandatory password change policies, so you would never end up asking me :D

† I can't tell you now because the day after I ceased working for them I sent the nice leather-bound book I write passwords down in to my Product Owner, so that the answer to all subsequent "Do you happen to remember the password for...?" questions would be "Either it's in the book which you have or No". To be fair he only called me and asked that question once, which is why he was my favourite Product Owner, "capacity to learn from experience: 10/10".

Writing passwords down on paper is literally the primary reason password rotation isn't recommended anymore.

If something got a look inside your book, everything is compromised. At least by changing to another random gibberish password, an attacker would not get back in (in contrast to someone that increments a number, for example), but how much damage can something do in that time before you notice? How long do you think it takes a skilled attacker to install a backdoor (the answer is definitely less than 44 days)?

This is the second major problem with password rotation: it is false security. If credentials are compromised, immediately change them: don't wait 45 or 90 days.

If they're not compromised, changing them is basically pointless, because humans are going to human and either have an incrementing number, predictable pattern, or actual complex, random, unrelated passwords ... that they then write down.

That's correct, if bad guys broke into my home and accessed the book it would have been game over.

Personally I would be much more concerned about other things - my stuff is there, not to mention often myself - but I'm sure that a vast faceless corporation would be primarily concerned with the potential for these hypothetical bad guys to learn and maybe disseminate secret passwords.

How often do you think that actually happens? It's a bit... high risk for opportunistic "cyber criminals" don't you think? Figure out where key employees live, then break in and... look for passwords they've written down and then presumably use them quickly before they're invalidated.

Writing passwords down on paper is fine.

Writing passwords down on paper and leaving that paper in an insecure area isn't.

Your little address book full of passwords is the same as a password manager, and for a lot of people it's easier for them to manage the security of a booklet than it is to handle a password manager properly. And for those people, it's definitely worth using a book for the sake reasons we say using a password manager is a good idea

I do actually use a password manager (zx2c4's pass) to manage my own passwords. But my mother has a book I purchased for her as an Xmas gift one year, for exactly the reason you described, I am confident she understands the security properties of a book, (e.g. a stranger left alone in a room with the book can read it) whereas I have my doubts with a password manager.

I used a book for passwords issued by that employer because at that time they lacked any in-house password manager and I foresaw from the outset that I would want to be able to hand them "my passwords" in the limited context of that employment as distinct from stuff like my personal Wikipedia account, my Google account and so on.

If I have a paper book of passwords at a desk in an open office environment, sure, that’s bad. If I have a paper book of passwords in a locked safe in a house, and there is perhaps a large German Shepard and multiple able-bodied adults living in that house, I’d say my password book is relatively secure.

Besides, actually remembering your passwords is a security flaw, too. Memorable passwords are naturally less random, and if the password is in my mental memory, an attacker can compromise my password by smashing me over the kneecap with a heavy wrench until I tell them. If I don’t even know my password, that’s probably bad news for my kneecaps but slightly more secure overall.

https://xkcd.com/538/

"Actual actual reality: nobody cares about his secrets."

Write down your password. What's your threat model- Spies breaking into your house or some skiddie doing password stuffing?

You can improve security of the booklet with secret splitting: type the strong part from the booklet then keep typing "hunter2" from memory. The (strong) booklet part protects from machines, the (weak) remembered part protects from humans. Weak passwords are ineffective only against machines, they are still effective against humans.

I suppose that typing "****" on the end of your passwords would work. Bit annoying to type out 7 asterisks every time though, maybe a word would be better?

When my house got burgled, they didn't even bother taking my MacBook, let alone any real books. Your average burglar is looking for cash and items that can be quickly pawned, not corporate secrets.

If someone did break into my house as an act of espionage (corporate or nation state), I'd be worried about much more than just my password security.

Did you just give away very predictable credentials from a very predictable person with full access to very predictable IT equipment?

With passwords that simple, it's crackable almost instantaneously without any preknowledge of the password format. That, coupled with the fact that systems get randomly attacked all the time, I doubt it's really that big of a deal.

Attackers don't need hints on passwords, they don't need hints on targets. They just target everyone, and try all easy passwords.

It depends on the context, if I have a hash it’s trivial to crack dictionaryword29, if I’m brute forcing a VPN/RDP endpoint, generally fail2ban are hard enough to block mass attempts (an AD default, iirc), the latter is usually solved by phishing which has the added benefit of MFA capture also.

Pentester here, to clear any dubious assumptions.

But if the password is salted is it still easy to crack?

Yes, definitely. The salt just means you have to compute a few hashes yourself rather than relying on a lookup table.

Yes... there are lists that are generally used for common variants of passphrases and can generally crack a simple passphrase like ggp in less than a day easily, faster or slower depending on hardware in use, concurrency and order.

4-5 dictionary words with proper sentence structure is a lot safer for the most part. Random safer still, but much harder to remember... my current password for work in a sentence with 24 characters. spaces, capitals and punctuation. Other than my OS and password manager, I really don't remember any other passwords I use, and the majority are random generated at this point.

I also use a wildcard mail forwarder, so most new sites I've used in the past year or two are all unique emails as well.

If you're relying on all former colleagues not inadvertently (or otherwise) giving away details that may (slightly aid in the) comprise (of) your systems...

It might be a good idea to omit the school's name.

Maybe the school doesn’t exist and is in fact a honey pot.

The school district certainly exists but that doesn't alter the honeypot calculus

There was a talk I saw some years ago of someone that analyzed enterprise passwords and the most common pattern they found was:

Dictionary word with first letter uppercase, followed by two-digit number, followed by exclamation mark. With the overall length exactly being the minimum length of the policy.

My first password is always secure. The second one less so, but by the third time you make me change my password it turns into easily predictable dictionary words.

A former coworker of mine used to track how long he was working with certain client by the amount of dots after their actual password.

I simply disabled password rotation policy on my account ノ(ジ)ー'

Reply on news.ycombinator.com