• Meldroc@lemmy.world
    link
    fedilink
    arrow-up
    103
    arrow-down
    2
    ·
    1 year ago

    And despite security recommendations, too many IT depts still force password resets every 90 days…

    And people confronted with this change their password from “p@55w0rd!1” to “p@55w0rd@2”. Yep extra-secure!

    • nomadjoanne@lemmy.world
      link
      fedilink
      arrow-up
      17
      ·
      1 year ago

      Ideally we’d all use password managers, but I’m aware 99% of peoole don’t. Even with one, it’s frankly a pain in the butt to be nagged about changing it. “Man, my passwords are 20 random characters. I don’t need yo reset ot unless you’ve had a breach.”

      • Surface_Detail@lemmy.ml
        link
        fedilink
        arrow-up
        3
        ·
        1 year ago

        Password managers are great. Until you need to log in with a new device or a device that’s not yours.

        Oh, the sixteen digit randomly generated password with two alphanumeric characters in it? Sure I remember that.

        • criitz@reddthat.com
          link
          fedilink
          arrow-up
          1
          ·
          1 year ago

          You gotta use word-based passcodes instead of random jibberish. That way you can quickly read it from your phone and type it in.

    • chrischryse@lemmy.world
      link
      fedilink
      arrow-up
      18
      arrow-down
      1
      ·
      1 year ago

      I work in the IT section of a bank and they force a change every 30 days and can only have an 8 character password no more no less 🙃

    • AlecSadler@lemmy.world
      link
      fedilink
      arrow-up
      15
      ·
      1 year ago

      A job I quit about 6mos ago required monthly changes. It was awful. And, yes, it absolutely led to me just incrementing a number at the end. I knew it was time to quit when I was about to hit double digit numbers.

        • AlecSadler@lemmy.world
          link
          fedilink
          arrow-up
          12
          ·
          1 year ago

          It was a joke.

          But also, holding a shitty toxic job for 10mos took a mental health toll.

          But also, I don’t know, in some cases that might be good advice. Since 2020 I’ve changed jobs every 6-10mos and I’m making triple what I made in 2019, so that’s nice.

    • Joe@discuss.tchncs.de
      link
      fedilink
      arrow-up
      11
      ·
      1 year ago

      @278 and going strong, across 7 companies. One time, just to mix things up, I used an exclamation mark instead. It was exhilerating. /s

    • The_v@lemmy.world
      link
      fedilink
      arrow-up
      10
      ·
      1 year ago

      Some IT guys have caught on to this and require 2 digits difference.

      So “ThisJobSucks#11” becomes “ThisJobSucks#22”

        • Blackmist@feddit.uk
          link
          fedilink
          arrow-up
          4
          ·
          1 year ago

          Well they don’t need to store it to a drive. You just entered your old password in order to login and authorise your password change.

          It’ll still be in memory against your session.

        • Hawk@lemmy.dbzer0.com
          link
          fedilink
          arrow-up
          3
          ·
          1 year ago

          Used to have monthly changes for a Microsoft account. When trying to change, it said “You used this password 6 months ago, please use another”, besides the “passwords needs to be at least this different” message. Clearly they are storing them, not sure if they’re stored cleartext or they’re decrypting them on the fly somehow

          • psilocybin@discuss.tchncs.de
            link
            fedilink
            arrow-up
            5
            ·
            edit-2
            1 year ago

            You should not be able to decrypt a password, passwords aren’t encrypted but hashed, they would be insecure would they be encrypted.

            Hashing differs from encryption in that it is irreversible, because two or more strings might result in the same hash if the hashing function is applied to them (hashing is not injective).

            But since your password will always yield the same hash you can compare the two hashes and if they are equal you are considered authenticated. If you try to log in with a different password (or even the hash of the correct password) then it will produce a different hash resulting in a failed authentication attempt

            The way crackers get a password if they have the hash is by guessing pw candidates and using the hash function on them, if its the same as the hash they have they found the/a valid password. The guessing can be quite involved and with enough time and data about a victim often 12-13 digit passwords with special characters and all can be cracked - If the victim used a somewhat mnemonic pw that is. Generated pws from a password safe are much safer (but usually also longer).

            In your case I suspect MS was storing a history of hashes which is not advisable as it gives potential crackers more to work with, but its way less bad then storing plain text or encrypting passwords

        • StimpyMGS@feddit.nl
          link
          fedilink
          arrow-up
          1
          arrow-down
          1
          ·
          1 year ago

          No you don’t need to store anything in clear text to check password parameters

          • Xanvial@lemmy.one
            link
            fedilink
            arrow-up
            6
            ·
            1 year ago

            But you need to know previous password if the objective is to make sure there’s at least two characters difference compared to new password

              • psilocybin@discuss.tchncs.de
                link
                fedilink
                arrow-up
                3
                ·
                edit-2
                1 year ago

                I mean “because password hashes” is basically my original rational so not sure it qualifies as a counter argument.

                But the link you provide is more explicit:

                When the user enters the new password, the system generates the variations of the new password entered, hashes each one of them, and compares each hash against the old password’s hash. If any of the hash matches, it throws an error. Else, it successfully changes the password

                It is possible to hash all 1 character variations I guess, I kinda doubt that it is done often (does anyone know a library?).

                I guess complexity increases linearly so password length is might not severely limit this mechanism. It would be interesting to see a calculation of how long it takes for a long password can to calculate all possibilities for 1 char variations for utf-8 or other charsets

                Thanks for sharing the link!

        • Reliant1087@lemmy.world
          link
          fedilink
          arrow-up
          1
          arrow-down
          2
          ·
          1 year ago

          You could take the old password, change one or two letters and compare the hash to the hash of the new password?

          • psilocybin@discuss.tchncs.de
            link
            fedilink
            arrow-up
            7
            ·
            1 year ago

            That’s the point though.

            You’re not supposed to have the old password. If you had the old password you could just compare it to the new password.

            The only way you can do it is to take the new password and make a hash for every possible single-character variation and compare them all to the old hash

            • abraxas@lemmy.ml
              link
              fedilink
              English
              arrow-up
              1
              ·
              1 year ago

              They shouldn’t be storing the old password hashed, either. Expired password hashes should be destroyed like any other potentially-sensitive information that is no longer business critical.

              There is a reason hackers look to get users tables even though the passwords are hashed. Because with enough of them and enough time, they can usually figure out plaintext. Giving them 10 previous hashed passwords for each user is just increasing the hypothetical risk.

              • psilocybin@discuss.tchncs.de
                link
                fedilink
                arrow-up
                2
                ·
                1 year ago

                You’re right ofc if you wanted to make a general remark, but wrong if you thought that was what I was implying. Never store hash histories, kids!

            • Reliant1087@lemmy.world
              link
              fedilink
              arrow-up
              1
              ·
              1 year ago

              Sorry, that’s what I meant as well :) Came out upside down when I wrote. We used to figure out shitty ISP router passwords this way by having a table of common passwords and their hashes.

      • Narjah@lemmy.world
        link
        fedilink
        arrow-up
        9
        ·
        1 year ago

        I college we had to change our password every semester. Guess who added the semester number onto the end of their password. Hint: everyone.

        Same as a government job that required monthly password changes. Well, at least those people had more security than the post-it note on the monitor people

      • Default_Defect@lemmy.world
        link
        fedilink
        English
        arrow-up
        3
        ·
        1 year ago

        NavyExchange!(ddmm of password change) for as long as I worked there, it was really only to use a register though, I had nothing compromising behind the password lock.

    • tool@r.rosettast0ned.com
      link
      fedilink
      arrow-up
      5
      ·
      1 year ago

      And despite security recommendations, too many IT depts still force password resets every 90 days…

      It could be for contractual or for insurance reasons. We have some contracts with government agencies that require it, and our cyberinsurance also does. Even though NIST has been recommending for years to do long passphrase + MFA and no reset unless you suspect compromise.

      So yeah, the reason behind this might not be just plain incompetence.

    • Stuka@lemmy.ml
      link
      fedilink
      arrow-up
      5
      ·
      1 year ago

      The worst is when you have a bunch of independent systems that all have their own login info, all configured by the dame IT department, all with different forced reset timers.

    • abraxas@lemmy.ml
      link
      fedilink
      English
      arrow-up
      4
      ·
      1 year ago

      I’ve had arguments with clients’ IT security about this in the past where they demanded forced password resets. Citing NIST controls that insist you should avoid them was apparently insufficient.

        • pulverizedcoccyx@lemmy.ca
          link
          fedilink
          arrow-up
          5
          ·
          1 year ago

          Then you finally do the password change, go to login and now the new password doesn’t work because you copied it to clipboard and overwrote it somehow in that small time frame goddamn shit! I always win+r and put it there until I know everything is all good.

            • topher@lemm.ee
              link
              fedilink
              arrow-up
              5
              ·
              1 year ago

              Coming from a Linux background and being forced to use windows 10/11 at work, this was a game changer for me when i accidentally mis-keyed this shortcut and turned on the history feature. Now I use it literally dozens or hundreds of times each day.

              Task failed successfully!

    • Thassodar@lemm.ee
      link
      fedilink
      arrow-up
      21
      ·
      1 year ago

      What if I were to tell you my password manager password is the most vulnerable of all?

      Nobody would guess it’s hunter2.

    • totallynotarobot@lemmy.world
      link
      fedilink
      arrow-up
      8
      arrow-down
      1
      ·
      1 year ago

      I promise you that does not help.

      I suspect a large number of these incidents are due to the password field in the login page allowing fewer characters than the field in the sign up page, so the password gets truncated. A couple of help desk meat shields have confirmed that for me, but mostly I think this because it seems to fix itself if I use a shorter password.

      How short, you ask? Who tf knows! They sure as shit won’t tell you! Just spend the next 20 minutes trying shit til it works, because you have nothing better to do with your time!

    • pulverizedcoccyx@lemmy.ca
      link
      fedilink
      arrow-up
      5
      ·
      1 year ago

      My parents. All written down on paper in handy notebooks for anyone that breaks in. Two entire lives and everything in them just there for the taking.

      • abraxas@lemmy.ml
        link
        fedilink
        English
        arrow-up
        4
        ·
        edit-2
        1 year ago

        If I recall, a few (most) security experts now support written-on-paper passwords. Why? Because it is the solution for users who would otherwise commit far a more egregious security faux pas otherwise.

        In most circumstances, it is easier to keep the notebook secure than your wallet, your car, etc. And let’s be honest, the list of suspects are REALLY short if someone breaks into your house, opens the third drawer, grabs the notebook and runs. And if it’s more than that and somebody ransacks your entire house, I guarantee having to change your passwords is the least of your headaches.

        Ultimately, physical compromise is the lowest possible security risk for most people throughout their lives. Yes, it happens. Yes, it sucks. But having your bank password out in the wild with nobody realizing it is possibly far more dangerous.

        • sawdustprophet@midwest.social
          link
          fedilink
          arrow-up
          2
          ·
          1 year ago

          My grandma does this, but they’re in one of the many Bibles she has in her home.

          “They stamped it, didn’t they? Those damn Gideons.”

    • Psythik@lemm.ee
      link
      fedilink
      arrow-up
      3
      ·
      1 year ago

      I do use a password manager but this shit still happens. Does anyone know why? Something to do with a “password hash”, I think…

    • SamboT@lemm.ee
      link
      fedilink
      arrow-up
      4
      arrow-down
      1
      ·
      1 year ago

      1 week later: EZ Pass has majority of user passwords compromised, giving hackers access to bank records of 8 million Americans.

      • FlexibleToast@lemmy.world
        link
        fedilink
        arrow-up
        3
        ·
        1 year ago

        That’s even more reason to use a password manager. You’re far more likely to have unique passwords per site. If one gets compromised, others don’t.

        • SamboT@lemm.ee
          link
          fedilink
          arrow-up
          3
          ·
          1 year ago

          Idk who is safe to use for password mgmt. I haven’t seen data leaks for my banking institutions who probably have enforced regulations for IT security. Are there standards in place for password manager products? What brands are reputable?

          • FlexibleToast@lemmy.world
            link
            fedilink
            arrow-up
            1
            ·
            1 year ago

            Yourself. I use Vaultwarden on a Raspberry Pi. Lots of people use something like KeePass and sync it with Dropbox or something similar. As far as someone else hosting it, Bitwarden seems like the go to (and is the project that Vaultwarden is based on).

      • Gormadt@lemmy.blahaj.zone
        link
        fedilink
        arrow-up
        9
        ·
        1 year ago

        I won’t say where I work but we have strict password requirements including that they have to be exactly 8 characters long.

        Yeah our passwords aren’t very secure as we also have to change them every 90 days and if you miss the window by 3 days you have to call the IT desk to reset it which takes about 45 minutes to an hour. And in that time you basically can’t get anything done.

        At home I use a password manager and all my passwords are randomly generated and whenever possible 2fa is enabled.

        • Trapping5341@lemmy.world
          link
          fedilink
          arrow-up
          11
          ·
          1 year ago

          Personally I would use a password manager for at work as well. Bitwarden can generate 8 character passwords. Easy enough to remember and if you forget it’s right there on your phone.

        • abraxas@lemmy.ml
          link
          fedilink
          English
          arrow-up
          7
          ·
          1 year ago

          Not sure if you’re in the US. But if you are, you should leave this anonymously on the security team’s desks.

          > Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator. - NIST control SP 800-63B Section 5.1.1.2

          Basically a fairly widespread standard of security. All kinda of complaince you can fall out of if you do business with anyone who cares about NIST controls.

        • TheMauveAvenger@lemmy.world
          link
          fedilink
          arrow-up
          4
          arrow-down
          1
          ·
          1 year ago

          Get as many people as you can to change their password on or around the same day. 93 days later either bombard IT with simultaneous requests or maybe stagger them to eat up their resources for days.

          • Gormadt@lemmy.blahaj.zone
            link
            fedilink
            arrow-up
            2
            ·
            1 year ago

            Pretty much how it is really, we also make sure to line it up when we return from holidays.

            Fun fact about our system, if you change you password on your own it restarts the clock from that day.

        • /home/pineapplelover@lemm.ee
          link
          fedilink
          arrow-up
          2
          ·
          1 year ago

          This is the proper way to do things (on your end, not the 8 character password at work). I also use email aliases from simplelogin in addition to strong and unique passwords. So any data breach from a site should be isolated.

      • topher@lemm.ee
        link
        fedilink
        arrow-up
        1
        ·
        edit-2
        1 year ago

        I use bitwarden on my android phone and home computer. Vivaldi browser on both devices with bw integration. I also was able to portable-load Vivaldi on my work pc, so one day when I’m not too busy, I intend to regen my work passwords (everything but the domain logon is web-based) with bitwarden so I never have to worry about how many ones and exclamation points I appended to my passwords.

        Now if I could only get them to replace Microsoft 365 OTPs with a smart card or RSA hardware token that’d be perfect. Especially when Teams and every other Microsoft app separately and individually decides for the nth time this week that they all need my credentials again because somebody sneezed near the work VPN server and caused the ntp to be off by a millisecond and invalidate my security certificate or… whatever the reason that happens.

      • abraxas@lemmy.ml
        link
        fedilink
        English
        arrow-up
        1
        arrow-down
        1
        ·
        1 year ago

        I do. This still happens to me regularly. Companies love to fuck with their password algorithms way too much.

    • GenderNeutralBro@lemmy.sdf.org
      link
      fedilink
      arrow-up
      4
      ·
      1 year ago

      The joke is that he set the password to the same thing he thought it was to begin with — the same password the site said was incorrect, it’s now saying was in fact his old password.

      I forget where, but this has happened to me before. I thiiiink the logic was that it compares to your last 3 passwords, not just the most recent one. So if I had the password “hunter2”, then changed it to “swordfish”, then later forgot that and tried to log in with “hunter2”, this is what would happen.

      I’ve also had similar but completely inexplicable experiences with my cell phone provider, who shall remain nameless. My best guess is that my special characters (still ASCII but not alphanumeric) broke their poor lil database. It wouldn’t accept anything until I set a strictly alphanumeric password.