Ask Slashdot: Changing Passwords For the New Year?

New submitter windcask asks "Every New Year's Day, I assemble and memorize a random collection of seven to ten mixed-case alphanumeric characters and proceed to change every password I have on the interwebs to these characters (plus a few extra characters unique to the site). The problem is I only change them on the sites I visit. Once in a while, I'll come across a site I haven't visited for a few years, and I may end up not being able to guess the password before the try-lockout takes effect. What are your password-changing rituals, and how do they deal with situations like mine? I do use Keepass for work, but it is sometimes impractical for times I'm at other computers."

Comments

Ahem

[Anonymous Coward]

What a good way to harvest guessing algorithms... Not giving you mine!

I don't care

[Threni]

I gave up caring a few years ago. I protect my online banking, amazon etc passwords (write them down at home, long and random) but everything else I couldn't care less. If my Slashdot/openid etc ones get guessed or whatever then I'll just create a new account. Don't kid yourself that anyone cares about your online persona - they don't. Friends will get an email from you about your new G+/facebook account. Everyone else will just not be interested in "RandomInternetGuy10248034034" now being known as "RandomInternetGuy23038908343". It's just not worth the mental effort remembering, nor the paper writing down 40 odd passwords. It's just some website.

Re:I don't care

[Dwedit]

This only applies to people who don't have Moderator or Admin privileges on websites. Otherwise, you need to keep your account safe.

As a regular user, the worst someone can do is a Joe Job, make the compromised account send nasty things to other users, or send a ton of spam.

But if you've ever been a Moderator or Admin, you need to keep your password safe.

Re:Password manager?

[artor3]

Because it can be inconvenient. Say I want to log in to a particular site on a friend's computer. I don't want to download KeePass on their PC, so I have to read the password off my phone. Reading and typing a 20+ character random string without errors is the opposite of convenience.

I don't

[smash]

I have sufficiently secure passwords that I see no benefit in changing just because.

There is extremely little value in changing.

[Above]

If you look at all the possible attack vectors and scenarios changing your passwords once a year change your statistical chances of being hacked or losing data very little. The ROI is low enough I wouldn't recommend changing your passwords on a regular schedule.

Picking good (as in hard to crack) passwords is more important. For random web properties using different passwords for each so when one is compromised and caught storing passwords in plain text only one account is compromised is key.

However, that's all not what I want to talk about. This entire question is the result of a huge failure of the industry. Every web site uses a password. Every one has a different idea of what a "good" password is, meaning if you come up with one (or use a generator) it won't always be allowed. Google has taken a step forward with their two factor options (via say, a cell text) but that's not really a practical option for many small web sites.

This is an excellent case for a PKI. Users should generate a public-private key pair, and provide the public key to the web site upon sign up. Extra authentication steps could be done at setup (web of trust a la PGP, known entities, a la X.509, callback texts, whatever). Users would sign a login blob with their private key to authenticate.

Using the same key for many web sites is much less dangerous. Compromising the web sites, and all the public keys, gets the attacker approximately nothing. They can be stored in plain (unencrypted) format on the web server. The only attack is to get the users private key, which can be encrypted on their machine behind passwords, biometrics, or whatever. Getting one user's private key gets you only one user, it's a low value attack.

What's needed is a standard format for this encrypted exchange, and then support by clients (from web browsers to ssh clients) and their corresponding server services. This is where the industry is letting us down.

If the big 15-20 web properties could get together with the big 4 browsers and make this happen it would be huge leap forward.

Re:I do not use the same password for multiple sit

[CapOblivious2010]

Far too many websites actually DO store the password (because they're idiots)

Re:I do not use the same password for multiple sit

[icebike]

That's exactly what I was thinking. For any site that maters, the most they can do is reset it for you, not tell you what it was. Most sites just don't matter. Other than your Karma, how much damage can be done when they hack your Slashdot password?

But I gotta ask, Why bother changing every year?

Changing a secure password offers no additional security. Its not like they wear out.

If crooks haven't broken into the login during the course of the year, changing it may actually make it weaker.
Those hovering over your shoulder to catch one key today and the next key tomorrow should be pretty obvious after a year, don't you think?
The key loggers would have found you long before the year is up, and the timing routines can be outfoxed by simply typing with only one finger, a different
finger each day.

Most sites that force you to change do so more frequently than a year. And 99.44% of them end up having users simply adding ascending digits
to the key, which becomes pretty easy to guess.

Re:I do not use the same password for multiple sit

[Fnord666]

Changing a secure password offers no additional security. Its not like they wear out.

If crooks haven't broken into the login during the course of the year, changing it may actually make it weaker.

One measure of the security of a password is the amount of time it would take to compromise it as compared to its useful lifetime. Assuming the password database is stolen today, would someone be able to compromise your password before you changed it?

Re:I do not use the same password for multiple sit

[Intropy]

Think of the websites you've used. How many at some point or another have actually emailed your password to you rather than just let you reset it with an email link? I know I have several dozen accounts and a few do indeed email me my password when I pick one. That means they have it in their data somewhere at least at some point in time.

Re:http://xkcd.com/936/

[kiddygrinder]

my bank requires passwords to be between 6 and 8 characters and one of those has to be a number... nice of them to make a nice neat brute force range.

Re:I do not use the same password for multiple sit

[plover]

Your statement doesn't take several risk factors into account. Ultimately, risk is something you have to assess for yourself: what is the value of your passwords? Are you guarding multi-million dollar corporate secrets, or are you risking a $50 credit card fee? It makes a difference as to how much effort to put into the task.

Long, random character passwords that are written down using actual pen-on-paper are still very secure against network based attacks. I have yet to see the virus that can read the password off a sticky note.

Having them on a piece of paper stuck in to your monitor in your house is going to expose them only to the people you invite in. Now, if you're talking about passwords at work, then you have coworkers, cleaning people, maintenance people, and all sorts of random passers-by that can read the note. Yes, those are less secure. But again, what are you guarding?

Having them inside a locked desk drawer improves the situation by quite a bit. Only someone who is specifically targeting you is likely to go after them. And if someone's targeting you personally, they'll probably do it the easy way with a keyboard sniffer or virus, rather than trying to break in to your office, bribe your janitor, or pick your desk drawer lock.

That said, in all cases you're still better off with an encrypted storage tool like a yubikey. Keep them with you, keep them encrypted. Much harder to leak that way.

Re:Congratulations

[shentino]

I keep my passwords safe by not bragging about my selection strategies on slashdot.

Re:Lastpass

[pionzypher]

I second lastpass.com.

IMHO it has by far the most elegant integration between chrome, FF, android browser and IE6 @ work. Changing passwords on a regular basis causes very little heartburn. Tinfoil hats need not apply though as your passwords aren't stored locally and you rely on the company keeping their db secure... For those who can get past that though, it blows kepass out of the water even when sharing the pass file via something like dropbox.