Hacker News Reader

Comment by sdoering | Hacker News Reader

Working at a acquisition of a big consulting corporation. Had these recommendations in place before being acquired. We're onboarded onto better security systems by new mothership.

Password rotation every 75 days. No dictionary check. No check against known breached passwords. No real reasonable rules against insecure passwords (like ac_Paul2022 is valid 'secure' password).

Additional massive "spyware" on corporate devices in the name of security.

I don't care about security since being 'on system'. I don't do anything private on these devices. So I couldn't care less about what mothership does with their spy-/securityware on said machine.

I couldn't care less about the security. I cared when I could do something about security. When I had control about the security on the device.

But why should I nowadays care.

View on HN

I worked at a small consultancy. We started without password rotation requirements, because it's more secure. We had to add them, because our clients' legal teams started requiring that their contracts with vendors mandate industry-standard security practices. Your employer was probably in a similar situation: certain practices are mandated by customer contracts, not actual security assessments.

It takes a long time for industry-standard to catch up to actual practice.

Second that, we get some corporate checklist from the customer and they want it green.

Explaining that it is not industry standard anymore takes time and if they want to take time of their employees using our system to deal with that, I am not wasting our company time to make them right.

I've had customers ask and question me about it. I write the policies and reference the relevant NIST guidelines. It's a good way to end those conversations quickly. Even fed compliance generally won't argue.

I know. TiSAX (automotive industry requirements standard) forces much of this onto us (just to name one example).

And if I am not mistaken even ISO27001 requires this to be compliant/certified.

Nope: https://github.com/dwyl/ISO-27001-2013-information-technolog...

I know of a non-zero and non-one amounts of the following passwords in idiotic "60 day rotation policies"

Password($MONTH)($YEAR)!

Or, PasswordJanuary2022!

It easily increments to deal with stupid arbitrary rotations, passes most tests, has the small/large/number/symbol requirements.

And it's sooooooo hackable its not funny. Hell, 2 jobs ago, I ran this precisely because of 60d rotation garbage.

Yes, I would do exactly this. At one company, I just kept adding dots on the end for each 3 month "rotation." I didn't stay there long. I think I got to 3 dots.

I think my cynical take is to not actually care. Very few people in the whole security industry actually bother to care because it's mostly box checking regulatory requirements and/or certifications because security beyond the absolute minimum just isn't important to the job. Most places aren't being attacked or broken into, and in the slim chance it happens there's less money to say "sorry for being breached, we're $worthless_cert compliant, nothing else we could do" because customers will believe it.

The corollary of this is that, as a user, you need to do your best do ensure that when your account is broken into, that it doesn’t matter to you either.

To get there though, we need better email hiding (Apple’s Hide My Email is great for this, you can get unlimited randomly-generated @icloud.com addresss that forward to your real one) and for sites to not actually need your real name or personal information.

If done right, if randosite.com gets all emails and (even if plain-text) passwords leaked, it wouldn’t matter because only Apple can tie the email to my account, and the password would only be good on that site anyway.

If a website actually needs my real address and name for billing information, that’s another matter maybe, but even then who really cares? The existence of my home address and name doesn’t much matter if they can’t tie it to any other online identities. My address is in the phone book too… it doesn’t really give anybody new information.

Fun fact: We are being shown how dangerous this internet is. With scary looking numbers of attacks per quarter. Until one scrutinizes the slides to see that not our mothership is the target of these attacks, but that these numbers (somewhat in the range of 350 - 500) are global numbers on companies of any size.

Since seeing this I became even more of a cynic. If they want to scare us - at least they should do it intelligently.

Most of these policies boil down to regulations or compliance. The financial industry, ironically, is a huge propagator of antiquated security controls.

We all knew that the controls were bad, but we had to use them

As a fellow person in finance... yuuuup. We switch passwords every 6 months and it is super annoying. A LOT of my coworkers are doing `password1` then `password2` which... sort of completely defeats the purpose of the policy.

r6N9P&vKjjgM r7N0P&vKjjgM etc

MarchPassword2022! is very easy to remember...

MyMarchPassword2022!1

Why should a corporation design its information controls for users who "care" about infosec, rather than designing for the overwhelming amount of users who don't care at best, and at worst are insider threats?

I agree in principle. But actively harming security for those users that already have a secure environment in place is a sign of compliance culture. Not security culture.

I needed to have less secure passwords under new security regime. More open ports. More services being exposed to the net, more code with potential bugs running on my machine and so on.

If you want to take over any of the big firms I would probably target a tool like Tanium [0] being employed by a lot of these corporations.

Last time I checked still based on python 2.7 (EOL 2020-01-01).

This was in my case installed as well as Flash with the pretense of security. I was a bit underwhelmed.

I actually told CIO about py27. And about it already being EOL. They did not know that (neither the tool using it, nor it being EOL). And they actually did not care. And told me not to care about it, as the mix of different tools would provide absolut security.

[0]: https://www.tanium.com/de/

I don't think poster was complaining, specifically, that the security policy wasn't designed for people who care about security. In my opinion the issue is that they replaced an up-to-date and robust set of policies and tools with out-of-date tools and procedures. In addition they removed agency from their employees by installing an endpoint security tool on their machines.

I have to say, I agree! Once an endpoint security tool gets installed on my laptop and my administrator privileges have been revoked, I would definitely feel like the security of the unit was out of my hands. IMHO, this makes the organization almost entirely reliant on software and policies (which likely go unread) for security.

My belief is that this will result in an overall less secure posture for the organization as a whole. As this poster points out, his password is now less secure because whatever tool judges its strength is behind the curve. Other people may be more prone to open suspicious email under the impression that the endpoint security tool will take care of it. And so on.

Reply on news.ycombinator.com