New answers tagged

0

You might be somewhat safe if your suffix looks like a year of birth. If I use myname1977 then there is less, but probably not zero, chance that someone knowing that password will guess that I changed it to myname1978. But why take the risk? (do as I say, not as I do; I increment, but only at work, because that's the only place that asks me to change my ...


0

Probably not the most secure answer, but I recently heard advice about what to use for passwords that change regularly: What is your goal or something else you are looking forward to doing in the next X months? Use that to make a password. So, if you are going on a trip to Disney World before your password is going to expire you could do something like ...


0

When I'm cracking passwords I will get your new password within the same second if all you do is increment. This is because I'm trying appended and prepended passwords before anything else and only after qwerty related schemes and the basic list of discovered passwords since it's been my experience that's what we humans are apt to do.


0

You should roll an entire new password. If there isn't a breach, I don't see the value in constantly rotating passwords. However--when you do rotate passwords, this is the key: You want to regenerate the password using a system with the same assumedly secure constraint you made the original password under. I.e. incrementing a number is NOT acceptable ...


1

If your password database is leaked, a good password can take some time to crack. By which time, quite likely, you have been forced to change your password. That concept is a large part of why these "security theater" forced password resets exist. HOWEVER, gaining access to your account is typically handled using an automated script. If the password ...


11

Changing only some portion of the password is [citation needed] very common, and a very bad practice. Entropy is a measure of how unknown something is. for the first time you choose random-fixed-beginning or a whole new password, both with the same amount of entropy, both alternatives will be equivalent. Ok. For the time you need to change your password, ...


4

In your case, the security of the sequencing scheme is decreased primarily due to non-cryptologic factors. Consider shoulder surfing. If you type the same password, day after day, year after year, your coworkers or other observers could notice the patterns. You could type the same password in different locations that have different levels of physical ...


6

Keeping a specific scheme is never a good idea even if enterprise environments that require frequent password updates/changes. For example if, like in your example, someone kept the same basic characters and only changed the password by a single integer, someone whom learns an old password could use the scheme to predict the changes. Take for example, the ...


3

I would elaborate somewhat on the explanation Sjoerd gives and approach it from a somewhat different angle. First one should ask what security goal is being achieved by the scheduled (as opposed to reactive) change of passwords? Why is your security division or best practice document forcing you to change a password every couple of months? There is a ...


3

Yes it is. Requiring users to regularly change passwords is a counter-productive bit of security-theatre (see CESG article) as it forces users to write down their passwords. If an attacker has managed to obtain a password, then they may have several weeks to install back-doors or slurp gigabytes of data off the system anyway before the password is next ...


34

You should not use this scheme, because once this password is known to an attacker, he can derive the "later" passwords. This could be the case in these situations: The password is shared between you and some other trused persons, and some day you decide to not trust (one of) them anymore. In this case, they could easily guess the next passwords. An ...


67

If an attacker has found out your password, he can access the system up until you change the password. Changing passwords often prevents attackers that already have your password to have undetected access indefinitely. Now, if your password is secret-may16 and the attacker is locked out when you change your password, he is certainly going to try ...


1

chage -M 99999: The password will be valid for 99999 days (until 21 feb 2290 if changed today) chage -M -1: This will remove the checking of the password's validity. So, unless your users are quite longlived (and are not going to change your systems passwords)… no, I don't see any functional difference ☺ That security scan doesn't seem too thorough.


1

Risk analysis All password policies render mandatory to change passwords on a regular basis. This is to reduce one risk, the risk that a password is compromised and that the owner of this password or the system using it to authenticate him wouldn't discover this compromise soon enough. Then this secret would have lost its key property. This probability of ...


0

The other answers provide good technical information on why this is not particularly secure. But it leads us to a conclusion that's interesting in its own right: Systems which require periodic password changes are not substantially more secure than the baseline, unless you're willing either to store old passwords unhashed (questionable at best) or to give ...


1

My question is, practically speaking, how much "less" secure is this than changing the entire thing? . . (again, this is asked from a general standpoint, ignoring user-targeted attacks, focusing on "lists of compromised accounts" that hackers may gain access to) I think this is a case where it's not good to generalize. Security is a very ...


3

There is the mathematical aspect which will change depending on the number of characters used and the number you can choose from. This can be calculated for any specific password for any specific system to get part of your answer. More importantly. For people who look at password dumps on a regular basis (penetration testers as well as a number of other ...


5

is there evidence of attempts to further crack these passphrases or is it more likely that your typical hacker will move on to the next account in his list? This depends. If the attacker can guess that your password changing schema is simply to replace a single character (maybe because he got access to your two last passwords or knows how you think) ...


-4

No, there cannot be an authoritative source because the statement is not true. There are times when you should give your password to other people. There are plenty of scenarios where the benefit of providing your password to someone is greater than the cost of the worst case scenario of providing them your password, and where logging in for them is made ...


6

An authoritative single source for this may be hard to find as it is, ultimately, subjective. However, not sharing credentials is a fundamental expectation of our current computing paradigm. The use of logins and passwords is fundamental to this reality and to step out of this violates that paradigm and every system that has been built around it. Access ...


13

In a corporate environment, there are a few places you can look. Company Acceptable Use Policies generally will have a clause saying not to share accounts or disclose passwords. If your company is subject to certain regulations (PCI-DSS, SOC2, HIPAA, etc.) they will have similar requirements. Because you want to communicate with your boss, there is a ...


1

I once implemented something like this. The longest known words would be removed from the password before checking its length. So if you enter "test438" as a password, "test" is removed and "438" is obviously too short to be a password. This still allows for passwords that combine multiple known words. Some people that had passwords like "Test1234" ...


1

It's not used widely because if you block 123456, users will use 1234567, you block qwerty they'll use qwertyu. Honestly, "The blacklist approach will be bypassed". And this makes the outcome minimal, to the extent that its not worth implementing. The approach could be beneficial but when coupled with other types of policies like min-length, uppercase, ...


0

I don't think there is one good answer but here are some suggestions. You could utilize a captcha with extra visual artifacts or more characters than normal on every login. Perhaps a simple riddle or a bit of javascript that forces a user to click on targets with a time limit like this. I think the most feasible, reliable option would be requiring two-factor ...



Top 50 recent answers are included