Slashdot Mirror
Please Do Not Change Your Password
cxbrx writes "Mark Pothier's Boston Globe article, 'Please do not change your password,' covers a paper by Microsoft Researcher Cormac Herley, 'So Long, and No Thanks for the Externalities: the Rational Rejection of Security Advice by Users,' from the 2009 New Security Paradigms Workshop. Herley argues 'that user's rejection of the security advice they receive is entirely rational from an economic perspective.' Herley discusses 'password rules,' 'teaching users to recognize phishing sites by reading URLs,' and 'certificate errors.' Users obviously choose bad passwords, but does password aging actually help? There was some discussion on TechRepublic. I'm especially interested in hearing about studies about password aging."
We have a password expiration policy at my work. Every time I change my password I have to memorize a new one. So I pick a password that's easy to remember, as such it's also easy to guess. If I could just memorize a password once, and keep it forever I'd be using a password that's essentially random. This policy is nonsense.
Give me Classic Slashdot or give me death!
Password aging is one of those policies that sounds like it makes some degree of sense only if you don't have any understanding of human nature.
Here in reality, forcing people to change their password every 30 or 60 or 90 days only has a few possible results:
(1) A lot more people writing down passwords and sticking them to their monitors. Who the hell can remember a new eight-digit string of nonsense every month?
(2) A lot more easy-to-guess passwords
(3) Incremented passwords (FuckTheSecurityGuys14)
This is why I consider password policies a great indicator of where your IT department is on the "keepin' it real" scale: No restrictions, you IT people are idiots and don't care or understand security. Reasonable restrictions (min 8 characters, letters and numbers) and you're in the sweet spot. Passwords that expire every 15 minutes, your IT people are idiots and don't care or understand security.
Every year during my review, I just pray the words "slashdot.org" aren't mentioned.
Password aging is not only irritating for users, it causes them to choose even worse passwords, or to write their passwords down. If you are lucky, and they do neither of these, then it is very likely that they will use "strong-password-1", "strong-password-2".
Enjoy life! This is not a dress rehearsal.
You neglected another possibility: your security restrictions were set by some dumbass in a state legislature who read some paper or book regarding "IT Security" and passed laws and regulations for government agencies...
Password aging is one of those policies that sounds like it makes some degree of sense only if you don't have any understanding of human nature.
The stereotype is that computer geeks can't get a date or fit into social situations. Why? Because they don't understand human nature. And who is in charge of setting the password policy? The geekiest guy in the organization. I see a major issue.
Aah, change is good. -- Rafiki
Yeah, but it ain't easy. -- Simba
Password aging made sense, once upon a time. When the biggest issue was resource theft, changing passwords every few months cleaned out the unintended access some people had, either nefariously or through chance (old unclosed account and what have you).
Now with the speed of automated hacking tools password rotation is less than useless as a defense.
And this points to a huge problem in IT departments, companies in general and our whole society. So much effort needs to be put into CYA activities, not because you're not doing your job right, but because you are liable to be subject to the whimsical judgement of stupid or ignorant people. Appearing to do the right thing is perceived as much more important that actually doing the right thing because failures of appearance tend to have much worse consequences. Look at Congress, 90% of what they do is so they appear to taking positive action on some issue, regardless of the effects it will have. And for them, it clearly works because they keep getting re-elected despite being the most consistently incompetent group of people drawing a salary in the U.S..
You are in a maze of twisty little passages, all alike.
Don't feed the trolls.
I want peace on earth and goodwill toward man.
We are the United States Government! We don't do that sort of thing.
Please cite some incidents traceable to the writing down of passwords.
IMHO users should be instructed to write their passwords down in a little black book and to keep that book in their wallets with their money and credit cards. The company should issue the book and teach the employees how to record passwords in it, how to keep it secure, and what to do if it is stolen or lost.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
Increased security always decreases usability. Though now that I think about it, I'm wondering: why aren't smart cards used more in corporations? Wouldn't it be convenient for people to log in with the same ID they use to get into their workplace building or floor?
Just a thought...
Amen! The concept of "password" is obsolete. Just never use it. Say "passphrase" and watch the light bulb go off as people realize it is easier to remember *and* more secure.
The problem with password rules, unlike rules passed by city councils or congress, is that we can use computers to completely enforce them.
That immediately points out exactly how useful real-life rulez are, too but I won't get into that except to say that civilization creates laws, laws do not create civilization. As proof, look at any political revolution.
Getting back to passwords, the rules have very little to do with desired goals--no break-ins.
Seriously, how many accounts are hacked by guessing passwords? Brute force guessing is stopped by a 3 and out system rule for bad pwds. Continued access from a compromised pwd is a serious issue but 1) the account first has to be hacked and 2) continual access from different machines can be monitored by the sys admins without user involvement.
Just a modicum of analysis shows that if you implement no reuse and a 45-day timeout, then each user has to come up with 8-10 hard-to-remember passwords each year. FOR EACH ACCOUNT.
The rule is as silly as Citibank's warning on the envelope they send me that a paper trail is an identity thief's best friend. How many of those crimes occur via paper and how many occur electronically? They just want to make their jobs easier and more cost-effective.
Pretend it would take about two months of processing time for a computer or cluster of computers to crack your 16 character length password with symbols, uppercase, lowercase and numbers. Now imagine that if your password were to be changed every month that the two month duration attempt to crack the password is useless since the password has changed and another two month attempt would have to be initiated.
That is an incorrect argument made by somebody who knows nothing about statistics.
First, if the time taken to crack a password is two months, and you change your passwords every two months, then there's a 50% chance of cracking the password in the first attempt, and a 100% chance of cracking the password the second attempt. So your example doesn't work.
Now, suppose a cracker has a, say 1% chance of guessing a password per month of attempts, and is attacking, say, 10,000 accounts. On the average, the cracker will have a ten hits every month, but he will only break your account, on the average, once every 8 years. Still, that's a 12 percent chance of you getting compromised in a year, and a 6 percent chance you'll get hit in six months. So, can you reduce that 6 percent chance by changing your password every 2 months? NO. The chance that your change password moves into the window of passwords that the cracker is going to try next month is exactly equal to the chance that the password change moves the password out of the window the cracker is trying. The odds of the cracking succeeding does not change at all by password changing.
The number of passwords that the cracker guesses per month does not change.
http://www.geoffreylandis.com
So what you're saying is, you hamstrung 100% of employees to still leave 10% of your employees vulnerable, when no doubt it only takes one opening for anyone to get to any information that matters on your network...
Explaining that joke on /. is like explaining who Jesus was to the Pope.
You should be ashamed.
hunter2 is "very good" according to my password strength meter. Add a "$" and then it will be strong. (Supposedly)
I get tired of changing passwords because I tend to forget the new one. I'd rather just keep it. For crucial things like banking or stocks, then I'll use a separate unique PASS and then lock it in a safe for future referral.
"I disapprove of what you say, but I will defend to the death your right to say it." - historian Evelyn Beatrice Hall