Microsoft’s research team studied this extensively. They looked at what actually happens when you enforce complexity requirements. Users don’t create randomly generated passwords. They follow predictable patterns. Capital letter at the start. Numbers at the end. Exclamation point at the very end. The word “Password” appears in about eight percent of “complex” passwords. When you force rotation, users increment numbers. Summer2024 becomes Fall2024. Or they add exclamation points. Or they change a single character and call it done. The false sense of security is dangerous. IT departments see compliance numbers go up. Everyone is following the password policy. The auditors are happy. Meanwhile, actual security hasn’t improved at all.
new policy: your password must not have been used by any other user in our system. That’s it.
“Sorry, you can’t have that password. Someone else’'s already using it” is an amazingly useful piece of information to give someone, even an existing employee.
Every competent InfoSec dept knows that NIST recommenda a strong password you never rotate unless compromised and yet every corporate policy I’ve ever witnessed forces password rotation constantly.
Security is 100% theatre.
All this is correct. But I’ll also add the following:
Most people probably DGAF if their password for work is compromised. They have no skin in the game for whatever their data entry or email is for BigCorp, they’re treated like “monkey push button, monkey get banana,” forced to jump through password hoops and they’re sick of doing it every few weeks or months. So they use the simplest they can get away with and the easiest to remember so they don’t have to call some corpo IT help desk that will roll their eyes at yet another password reset.
This is where “notebook full of passwords” works better, those accounts are technically “shared corporate property”. Protect it like you would any other equipment, with a physical lock.
Oh noes! Not my work microsoft account! Hack anything but that!
Damn, someone figured out my super secret formula for making super strong passwords! What am I going to do‽
Capital letter at the start. Numbers at the end. Exclamation point at the very end.
It’s scary that this is a pattern so many of us does instinctually.
It’s a good thing I began using KeePassXC 2 years ago…They’ll never figure out my secret technique… TWO exclamation points!!
You noob !!!
Damn, this guy might be stronger than me… what could defeat the power of THREE exclamation points‽
An interrobang? In this economy?
I was so happy when we finally hired a director of security and the first thing he did was stop forcing us to rotate passwords every month.
It was so fucking insane.
Even NIST stopped recommending pw rotations.
To their credit, none of the businesses I have a pw for require changes anymore. Also, to their credit, I can use long pw’s now. Some used to restrict to 8 chars max (!?) But against their credit, many still restrict the pw content, like you can’t use non-letter symbols or w/e.
Very old operating systems used to have a method for password hashing built in that could only handle 8 characters max. The need for compatibility with it, or things that were too zealous in being compatible lingered for a very long time.
It’s not good, but some services end up behind firewalls that reject inputs that look like SQL injection. Sometimes they decide it’s better to prevent sql-ish passwords than risk some weird fluke.
Sometimes they just say |, I, and l all look too similar and our users are idiots. Which is awful practice.My personal feeling is that password length should be capped with the length of input the system can handle. Plaintext copy of Alice in wonderland from project guttenberg? Go for it.
MONTH??
It’s monthly at my company. Combined with other complexity requirements, it’s pushed everyone into such predictable patterns that I could probably guess my way into any manager’s PC in probably a few minutes.
Also, there’s no lockdown after X attempts. I can try infinitely, as far as I’m aware.
Also, there’s no lockdown after X attempts. I can try infinitely, as far as I’m aware.
Eh, AFAIK that’s not a best practice anyway, at least not any low number. From what I recall, the recommendation is to either have a high number of attempts that causes a lockout (50+?) or high-priority alerts when a large number of invalid attempts is detected. One of the problems with lockouts based on X attempts, especially low numbers like you often see, at least in my mind, is that it opens people up to a denial of service attack. Let’s say that all account names are predictable, like first initial and last name. A rogue user could lock out anyone they wanted to with that knowledge. What if they know or can easily predict the usernames for all admins or IT people in the organization and they lock them all out?
Typically you want to do the lockout for a location, not the user, or you step up the auth level. 3 bad logins -> please mfa before trying again.
But yeah, letting an attacker do that at will is bad. I’m a fan of token bucket rate limiting with exponential back off. You get 10 attempts. A new attempt is added every second. An attempt while the bucket is empty makes that become two, then four and so on.
Most people never notice because a buffer of ten and a new attempt every second just never runs out. If you accidentally hold down enter you’re only blocked for a few moments. A dumb attacker quickly locks themselves out forever.
Our organization got hacked and there was about a year after where CISO had us changing passwords every two weeks.
ThisPasswordisforJANUARY1stMonth!
That was the recommendation for years.
It was commonly 90 days for regular user accounts, and 30 days for admin/privileged accounts.
with automated password rotation, and no api access (no permission to use api access, that is) to the keyvault. And they expected us to automate stuff too!
I had companies where it was monthly. suxed
I’ve done a lot of internal infrastructure pentests, for companies of various sizes, and there wasn’t a single pentest where spraying MonthYYYY for the past two months wouldn’t get at least one hit.
That, and the fact that every company has at least one server hidden somwhere that’s still vulnerable to MS17-010, that they can’t update or replace for one reason or the other.
You are 100% describing my company… Still relying on SMB1 protocols and a “server” running windows XP in a closet somewhere. But we have 4 different passworded accounts minimum to do our job, and they all rotate at different times and can’t reuse varying amounts of previous passwords and have different requirements to be accepted… It is a nightmare to the point everyone just saves their passwords to the browser and/or write them on a pad of paper sitting on their desk. This includes computers that are in an area open to the public that anyone could just walk up and start using.
That is an absolute nightmare.
I assume if special characters were required then it became MonthYYYY!, yes?
It makes me smile a little to know that the spirit of ms08-067 still lives on in some way.
I was pretty sure that was eternal blue but didn’t believe it would still be relevant 10 years later.
To be fair, last internal pentest I was doing before switching jobs was like more than 5 years ago, so the situation might’ve changed.
More people need a mooltipass and Keepassxc
here is the thing about working at a corp. I ask IT if there is a vetted password manager to use. They say they don’t have one. If I use one now im storing company passwords on unvetted software. thing is the corp has you do all this training and have you sign off you will keep to its guidelines.
Good god, that’s the exact conversation I had with IT
Same. Where I work everyone switched to storing them in Excel.
Mine’re in onenote. First page in the section I have for each app. If they don’t have obscene password requirements that force me to generate random ones they’re in code at least. Otherwise… plain text.
yeah it kinda drives me bonkers. there is a security team and they have all sorts of things that don’t always make the most sense but they don’t insist the company get a centralize password manager solution.
Came to the comments and you were downvoted?
Downvoter, what’s the problem with these tools?
I’m always correcting my accidental downvotes on Voyager… don´t get too bent out of shape about a single downvote.
Don’t let the user choose their password. Use passkey and randomly generate a secure password. Encourage passwordless login.
generate a secure
passwordpassphrase.This leads to endless resets as users fail to manage the unmemorizeable passwords, which as you probably know, exposes these kinds of users to new risks via email etc…
Which is why I prefer magic links. Not the securest form, but much more secure than a password, and it is still very easy for users to login.
No shit, Sherlock ©. I know nothing about cyber security and even I read somewhere years ago exactly the same: forcing password rotation with complexity rules does not make anything more secure
Yea it does one thing.
It hides exactly when there was a breach somewhere that forced a password reset.
Which is good when you know there will be a breach and mass password reset and want to cover your ass. Thank you, now it makes sense
I do the exlamation mark thing!!!
Hunter2!
Your password is all asterisks?
I!also!do!it!sometimes!
Now tell us about passkey.
