Slashdot Mirror
Frequent Password Changes Are the Enemy Of Security, FTC Technologist Says (arstechnica.com)
Though changing passwords often might seem like a good security practice, in reality, that isn't the case, says Carnegie Mellon University professor Lorrie Cranor. Earlier this year, when the Federal Trade Commission tweeted that people should "encourage" their loved ones to "change passwords often," Cranor wasted no time challenging it. From ArsTechnica's story: The reasoning behind the advice [of changing password often] is that an organization's network may have attackers inside who have yet to be discovered. Frequent password changes lock them out. But to a university professor who focuses on security, Cranor found the advice problematic for a couple of reasons. For one, a growing body of research suggests that frequent password changes make security worse. As if repeating advice that's based more on superstition than hard data wasn't bad enough, the tweet was even more annoying because all six of the government passwords she used had to be changed every 60 days. "I saw this tweet and I said, 'Why is it that the FTC is going around telling everyone to change their passwords?'" she said during a keynote speech at the BSides security conference in Las Vegas. "I went to the social media people and asked them that and they said, 'Well, it must be good advice because at the FTC we change our passwords every 60 days." Cranor eventually approached the chief information officer and the chief information security officer for the FTC and told them what a growing number of security experts have come to believe. Frequent password changes do little to improve security and very possibly make security worse by encouraging the use of passwords that are more susceptible to cracking. The CIO asked for research that supported this contrarian view, and Cranor was happy to provide it. The most on-point data comes from a study published in 2010 by researchers from the University of North Carolina at Chapel Hill.
The current discussion is a password change for our DMZ servers every 30 days. The mid zone servers are currently every 60 days. And corporate accounts are set to 90 days.
[John]
Shit better not happen!
"Frequent password changes lock them out. "
I was under the understanding the static passwords were an issue because they are far easier to brute force in a long term campaign, as well as a couple other reasons...
Policies that require frequent password changes lead me to:
- pick easy to remember (and therefor easy to guess) passwords
- restrict the character space I use in passwords, e.g. when special characters are required I pick from only 2 special chars.
- Reuse passwords. I have about 20 different password-protected accounts for work, all are changed every 90 days, except the one system where the requirement is 60 days. That's over 80 passwords per year. As a result I use 1 password internal systems and 1 for external, so at any time there are only 2 passwords I need to remember.
- Write down passwords. Sometimes it seems as if just as I'm getting to the point where a password is really ingrained, where I can get it on the first try even before caffeine, it's time to replace it with a new password. So you better believe I write them down.
Frequently changing passwords exclude adherence to most other security good practices.
The best practice lies somewhere in the middle. Change them too frequently or infrequently and security may be decreased for different reasons.
(This also depends on your definition of "frequently")
I *believe* that a password change policy is necessary. However, I don't think you need to change your password every couple of months. I think once a year is good as long as you are not using that password elsewhere and that it is 12 or more characters (don't worry about the numbers, symbols, etc. Just the length is important... again, with caveats pertaining to how the password is entered, stored, transmitted, etc)
My eyes reflect the stars and a smile lights up my face.
last password: Spring01
new password: Spring02
mora than 2 password to change now and then, advice from seniors, put them on a txt-file on the desktop
Use an offline password manager that generate random strong passwords, like keepass.
Be or ben't
Some of these questionable policies are driven by business regulations and auditors. If you're going through a PCI or Sarbanes-Oxley certification process you're going to have to get all of those checkboxes marked on the auditors' spreadsheets, whether or not they make sense.
Good luck trying to get the auditor to explain why you need to change your passwords every 90 days, in my experience they can't defend their requirements and simply say things like it's "best practice".
...for one main reason. Can anyone tell me how the insider threat risk has changed in the last 6 years?
Take a look at the last few major hacks within corporations and social media networks. These haven't been minor breaches where a little bit of data was taken. No, we're hearing about millions of accounts leaked, and terabytes of data stolen, with Sony being a prime example of an inside job.
The entire point here is frequent password changes DOES have a purpose; to mitigate the risk and damage of internal attacks, as outlined in TFS. If the insider threat risk has changed significantly in the last half decade, then the advice to change passwords often IS the more valid one.
And as the Ashley Madison analysis revealed, it really doesn't fucking matter how often we tell users to change their passwords when they continue to pick horrible ones that require little more than a guess to "crack". Sadly, this trend has not changed in the last few decades of humans typing in passwords into computers. This is probably the strongest argument to remove the concept of human-generated passwords altogether, and go with some form of biometric-enhanced authentication.
If it's going to be rendered as a hash anyway, what's the difference between that and a bad password?
Why invest in expensive hardware that will be circumvented anyway? Six months after any technology is mandated, someone finds a workaround and the hardware is useless, whether via writing around the edge with a Sharpie or using a 3d printed eyeball.
Your insistence on complete security is unattainable anyway. People remain people no matter what we do. Modern thinking on this is "assumed breach". Protect what is important, use automation to make the rest irrelevant.
HBI's Law: Frequency of calling others Nazis is directly correlated with the likelihood of the accuser being Communist.
And yet oddly enough, few question the Microsoft default setting of 42 days
Maybe that was to give you a week to remember to reboot the machine before being locked out, as Win95 and early Win98 would only manage an uptime of 49.7 days before becoming unresponsive
https://sites.google.com/site/...
(The mouse pointer would move, but no click, double-click or right click actions would work)
"She's furniture with a pulse"
I guess I am a hipster. I was failing to reset my passwords before it was cool.
Silence is a state of mime.
It's the bullet point that is easy to implement that pushes your ITSM score upwards. Changing it every 60 days is B+, changing it every 30 days is A+, hey, if they got another + for it they'd have you change it ever 30 minutes. It's a cheap way to "improve" your security score because it requires no work whatsoever from your security management. Servers come with that option built in.
And while we're at it, same shit with "2 numbers and 3 special characters and at least 30 characters long...". Same bullshit. The longer and more complex the passphrase, the more "+" in your security rating. Why? Doesn't matter. It gives you a better security score. You are winner.
Management by numbers at its finest.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I have several passwords that require a "special" character. I've found it frustrating on the occasions when I need to enter these on my phone, having to switch to the symbols to enter my password. Now if a password requires a special character, I use one that is part of the default keyboard, which limits it to using a period.
Special character requirements might be fine when using a physical keyboard, but mobile devices change how people will use them.
... not using that password elsewhere and that it is 12 or more characters
Indeed. It is not the number of possible characters, C, from which the password is created, but the number of characters, N, that the password uses: The number of possible combinations is C^N which is polynomial in C, but exponential in N. (Thus, increases much faster with N than with C.) Adding a few "special" characters doesn't do nearly as much as adding length. That doesn't even really prevent dictionary attacks as most of the time the user only adds a 0, 1 or ! suffix to a simple word-password.
Per XKCD, use your own easily remembered/typed pass phrase (but not "batteryhorsestaple"!) Damn the sites that insist on using a number and special character but limit you to 6 or 8 characters. You can add a meaningful UC letter, number and special character if they insist: "MySisterHas5ReallyBrattyKids!"
I encourage users to make up passwords based on some useless obsolete memory occupying a permanent place in their brains. I tell them to start with the name of their childhood dog, that's easy, but then add onto that the entire phone number for their best friend growing up.... the one you'd dial 12 times a day? that's 10 digits you can always recall, occupying some space in your head that you otherwise don't have any use for. Tag that onto your dog's name and you have a memorized 18-digit password. Your head is full of this stuff. An old gym locker combination. An weird nickname you used to call someone. The punchline from a comedy bit you heard when you were 11. There's actually a lot of defunct, untraceable fodder permanently stuck in your head you can use to construct a decent password that you couldn't forget it you wanted to.
Take it easy, Charlie, I've got an Angle...
Every company I've worked for forced us to change passwords regardless of complexity. So I, and probably everyone else, used a simple phrase with a number to increment. I would have liked it if I picked a long, complex, hard to crack password that I'd be rewarded with a longer period before requiring to change my password. Would this make sense in practice?
Length, not size matters. Got it.
Yup. Such policies lead to very silly behaviour patterns. The oddest one by some margin was a coworker whose first way every morning was to the IT-Department to pick up his password of the day (i.e. "i forgot my password and need a new one"), take it with him, use it, deposit the print in the shredder on his way to lunch, come back to retrieve a new password, use it, dump it in the shredder on his way home.
Without fail for years. IT had his password ready in the morning at 8 and after lunch at 12:30 (he was very punctual).
That works for one person. Now try for a few thousands.
The point is here, though, that this is one coping strategy for insane password requirements. And yes, it is possible to do a sensible security strategy. That may take money to implement, though.
Like card+code (similar to ATM). Such systems exist for computer login procedures, too. This can double as a door access system, too, providing you not only with a control for computer access but also physical access to your premises.
If you shy away from expenses, at least give your people something to work with. It's of course easy for a CISO to require his people to use insanely complex passwords, not note them down and change them every other day. But that's blameshifting, that's simply offloading his work onto those who he should be working for.
And yes, writing a password down is not the worst thing you could do. It's actually quite sensible. As long as you keep this password with you. Put it in your wallet. That's ok. You DO notice when you lose your wallet, and if it is stolen or lost, the average thief will not know what to do with a post it sticking to your wallet with "6'nuKdarw" written onto it.
If you want to be sneaky, make your password part of a grocery list and tack that to your wallet. If everything fails, nobody would think that "1/4lbButter" is supposed to be a password.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
A password written down on a sticky note can't be cracked remotely. You have to be physically present in the room to have a shot. http://www.imdb.com/title/tt0086567/?ref_=nv_sr_1
If the password is sufficiently complex, and the system uses properly salted hashes, then it is infeasible to crack remotely via brute-forcing the password database. Simple passwords are susceptible to brute force cracking.
A better solution is to use both. Write down the complicated password, but append or prepend a memorized PIN. That way, if the written component is compromised, the PIN still has to be guessed.
Learning HOW to think is more important than learning WHAT to think.
Passwords in wallets:
Carry a business card (not your own) and steg the password on its back using some variant of the following:
"Ben O. Aronsen: 237 Smith Place #12 Roxbury Vt 05669 ---Sally has phone number". This stegs the password "237SP#12RVt05669" for a Bank Of America account.
Like the Purloined Letter, the password hides in plain sight. Ain't stegging wunnerful?
I like to write down fake passwords on post-its and leave them laying around for would be hackers to find. Most people probably aren't that cunning though.
HA! I just wasted some of your bandwidth with a frivolous sig!
lots of outfits have wildly inconsistent rules, change periods, and prohibition types on passwords. I ought to just be able to set time to expire as well as changing everything to "asspword", and be done with it.
if this is supposed to be a new economy, how come they still want my old fashioned money?