Hacker News Reader

Comment by ziddoap | Hacker News Reader

Please stop saying "change your password regularly". Despite being a theoretical security increase, it has been shown repeatedly that it is a practical security decrease as it encourages both simpler passwords and incremental passwords. It also makes your users hate you, which isn't great.

A security company should know this. It's been strictly recommended against in the NIST guidelines (and others) for nearing a decade now. I start to really question the expertise of any security company that parrots this outdated advice. What else are they not keeping up on?

Focus on monitoring, alerting, educating, etc. Force password changes only when there are indicators of compromise.

View on HN

Our organization contracts out our IT, I can cannot stress enough how bad/lazy their cyber security guys are. It feels like the owner told his directionless son "Hey boy, if you manage to pass this cert class I'll make you head of cyber security!"

Every few months we need to change our password. It cannot be a previously used password. It needs uppercase, lowercase, number, special character and minimum 12 characters. We have 2FA that is easily bypassed by going offline then back online once through login. We have 4 different active security suites running on our machines, and mandatory biweekly virus scans, at 10am (which cannot be changed). Every standard 16GB machine runs on it's knees all day long. But at least you can skip 2fa by turning off wifi real fast.

We made IT security a checklist compliance exercise and call it cybersecurity, and then we are shocked and surprised the main deliverable turns out to be checked checklists, not security.

Don't stop there. You can make some even greater efficiencies. By having cyber-insurance you can do nothing and just have someone pay you out money when you fuck up. There's no end of ways security theatre and half-arsed "compliance" can help lower standards,

To be fair, if using insurance and risking being hacked anyway has a higher expected net payoff than implementing a given set of security measures, then you may be financially incentivized (or legally beholden to your shareholders) to take the risk, get hacked and pay any fines if it gets discovered. The security literature refers to it as "risk transference".

Chances are your company ultimately exists to optimize for shareholder value

I personally can't imagine trying to be a cybersecurity person. I'd be going out of my mind, concerned with all the things I can't keep up with. As a full stack dev, if I don't know what's new in React 19 it doesn't really hurt anybody, but if the cybersecurity people aren't up to date, that could very well be the end of the company. Either you're hot shit, just think you're hot shit, or you simply don't care, and that blend really scares me.

Another measure is to use a password manager and long, random, unguessable passwords.

With no need to memorize passwords, you can change them as often as you fancy.

>_you_ can change them as often as _you_ fancy.

This is all that matters, regardless of whether a password manager is used or not.

Users should be able to change their own password (almost) whenever they want.

But arbitrary forced password changes from the admin should not happen unless the account has indicators of being compromised (even if all of your users have a password manager).

I run into issues where the password manager doesn’t update. And I also now have 4 managers (lastpass; chrome; edge; icloud keys) because of multiple platforms over the years.

I bit the bullet and moved everything to BitWarden. (The idea is that I could self-host it if the service becomes problematic.)

I would have thought the advice here would be use passkeys everywhere you can and avoid Totp altogether (particularly the sms variant which has real risks today). When I think big picture mfa exists because passwords are often assumed lost to infostealers, so changing your password seems moot for an adversary who is ready to brute force your mfa.

> I would have thought the advice here would be use passkeys everywhere you can and avoid Totp altogether (particularly the sms variant which has real risks today).

Why would you avoid TOTP altogether? Yes, SMS OTP is insecure because SMS is insecure, but OTP itself is fine, unless I missed something?

TOTP is phishable.

Passkeys address the phishing angle, but as always it’s a trade off.

With passkeys if someone gets remote control of your computer they have access to everything you setup a passkey for.

Typically people say “well full remote control is far less common than phishing”, and it is, for now, until everyone’s using passkeys and all of the sophisticated phishing attack effort just shifts to passkeys.

The obvious weak point here is all of the outsourced IT who aren’t specifically focused on cybersecurity. Every IT company is using multiple tools for central management that either allows remote control or remote execution, or there’s always in-house developers who realistically aren’t doing a security analysis of every third-party library they’re installing.

You can still require biometric to unlock passkey for each use, so the risk is really about authenticated session theft in that scenario

I think when compared with a breach in 2FA, changing your password is a good counter. But I agree that in the case of failed 2FA (total failure), an alert should be sent to the user: "password used to access account; but second factor authentication was unsuccessful; change password if this was not you".

It used to be a good idea with things like AD, where pass-the-hash attacks worked and hashes would be static until changed, and in environments where hashes were relatively exposed for cracking and used weak hashes.

Hopefully that is not the case now though, and I am surprised the advice has persisted... (though outdated gov standards probably played a part until recently)

For places that enforce password changes, I can always tell how old my account is by (password change frequency) * (counter I put at end of password).

My actual password choices are secure, memorable, and available even if I lose my phone or password manager. The counter is just an annoyance.

For places that enforce password changes, I can always tell how old my account is by (password change frequency) * (counter I put at end of password).

I can't because there is generally a limit to how many passwords it checks for previous use. So you can usually just start back at "1" for the increment after you hit "0".

I just use a strong PascalCase passphrase (as strong as feasible if they have a stupidly short limit) and the year & month of the last password change. Something like `PascalCasePassphraseButRandomlyGeneratedProperly2024-12` for one this month. Fits many composition rules (those are also recommended against) by having uppercase, lowercase, numbers, and punctuation. Doesn't repeat previous passwords. And the entropy of the actual 7-word diceware passphrase is about 90 bits, which is pretty decent.

> It's been strictly recommended against in the NIST guidelines (and others) for nearing a decade now.

And yet it is still the recommended practice for every IT department for pretty much all corps. Even AWS has their forced 90 password reset policy where you start to get reminders 15 days early so it's actually 75 days. Only at AWS, they don't force you into the password rotation flow at the end of the 90, they automatically lock the account. While that might make sense for inactive accounts, for accounts that have clicked the Not Now for 14 days should be taken to a change password screen instead. /rant

>And yet it is still the recommended practice for every IT department for pretty much all corps

Not any that I or my colleagues consult at.

well congratulations to you. do you like to kick people when they're down to make yourself feel superior or was there another point to your comment? Great there's at least 3 companies that do not have this policy. That in no way negates all of the companies that do.

This is a really hostile comment. Sorry that your upset, but you don't need to take it out on me.

>or was there another point to your comment?

The purpose of my comment was to refute your claim that arbitrary password resets is the "recommended practice for every IT department for pretty much all corps".

Because it's not true.

>Great there's at least 3 companies that do not have this policy.

Between me and my colleagues we consult at dozens to hundreds of corporations per year. "At least 3" is pretty disingenuous.

sarcastic. not hostile.

do you honestly believe that i was unaware that there are companies that do not require the rotation policy? maybe the "pretty much all" phrase was confusing and you did not think that left room for some to not?

that's great that there are some companies that do not, but there are a great number of people that still do. it's not anything that needs rebutting as we're all aware they exist

>maybe the "pretty much all" phrase was confusing and you did not think that left room for some to not?

~90% or more of the companies we consult with do not have forced arbitrary password rotations when we start our engagement with them (~100% do not have it by the end of the engagement). We engage with dozens to hundreds of companies a year.

Does your definition of "pretty much all" actually mean "a small portion"? No wonder I was confused...

dozens to hundreds !== large percentage

I'm looking at a sample of well over a thousand companies across multiple years where the vast majority (~90%) do not have a forced rotation and now ~100% of them do not. You can safely extrapolate that out to a general statistic.

Where are you getting your numbers from? What data are you reviewing?

So by your own comment there were thousands of companies that absolutely were still using rotation policies until they were blessed with your consultation.

Sounds like your doing the lord's work. Godspeed

>absolutely were still using rotation policies

That is not what I said. In fact, that's the complete opposite of what I said! Here, I'll add some emphasis for you.

>"~90% or more of the companies we consult with do not have forced arbitrary password rotations ___when we start our engagement with them___"

> Even AWS has their forced 90 password reset policy

This is a policy set by the organization. You can easily change it to longer in IAM (or disable it entirely).

Sometimes, "you" are not able to do that and you just work for someone else managing that. I had 90 reset policy with 2FA. annoying AF

Another AWS set of creds is SSO+2FA, and no longer has the rotating policy. It's like a breath of fresh air.

Turns out, just like TFA, several security audits I've been through all list the password rotation policy in them.

Reply on news.ycombinator.com