Password Policy: Issue random generated passwords / Let the user choose a password

Question

I'm currently thinking about a new password policy. Originally I wanted the users to choose a password that is X digits long, contains numbers, special chars, lower and upper case,... but then I did some auditing in a friends Company. There they had such a policy. I extracted the password hashes from their Active Directory and let john crack the passwords using mangling rules. Many of the passwords were cracked when I choose to use a wordlist that was tailored to the company and its employees. They all used valid passwords according to the policy but using ones firstname, birth year and a random special char in the end isn't that secure.

Now I'm thinking about issuing a random password to every user that he can not change. The password would only be 10 digits long but wouldn't have any relation to the person which I think is much more secure. Do you think this is a good solution or am I missing something?

UPDATE: Two Factor Authentication is in general a good solution but will not work for us. We are a small company and implementing Two Factor Authentication comes with relatively high initial costs.

Answer 1

Best password policies: Strong, managed, and kept secure.

Strong

• long(12 or more characters)
• full character set required(upper, lower, number, symbol)
• no complete words
• no personal information if based on a word

managed

• kept in a secure location in case a lookup is needed
• changed regularly
• not the same as the previous pass
• kept hashed in a database behind a completely random password(of insane strength) or on a non networked database that requires physical secure access

secure

• recovery happens in person or thorough secure channels
• passwords are reviewed before changing(either automatic or on a schedule)
• no user knows another users password(if it's discovered they do and don't have a good reason for it, force a password change)
• option for 2 factor authentication to make it more secure

these tips are the best for password security and often get used on an enterprise level.

About 2 factor and some problems with it:

Of course that option for 2 factor authentication often gets tossed around as a "Why not just use 2 factor authentication then". Well there's actually a reason for this: you probably should for accounts that deal with sensitive data. Oh wait yeah there's also some pitfalls:

For everyone else this adds a physical layer of authentication that costs money, time, and setup as well as running or hiring a service to generate, and keep the authentication in sync. With networked and off site locations possible, this can run into some problems if not handled correctly, and over time always needs upkeep. Worse yet loss of keygen is a common problem, so backups are needed on site to be handed out, and if on a business trip 2 factor leads to a huge problem if lost. Then there's training them in how to use it, and forcing them to still have secure passwords. This takes a long time to get running(depending on the size of the company, this could actually lead to an entire IT overhaul), and requires training and staff dedicated to just maintaining it.

TL,DR:

Implement secure passwords, and talk to the company about password policy and maintenance. Then offer the option of 2 factor(and force it in some places if needed). Also always review passwords(either manually or through a algorithm) to confirm they aren't easy to crack or contain personally identifiable information. These best practices are enough to keep many companies safe. However never forget that passwords are only 1 part of cyber security.

As for giving out random passwords... well initially this is fine, but eventually the need to be rotated, and if that's the case then you should let them choose so they can remember it easier. If they can't remember it they will keep failing to login, IT load will increase due to forgotten passwords, and then writing it own on sticky notes and losing them now becomes an attack vector, or keeping them in personal email wit ha weak password, all sort of bad stuff, etc.. It would be better to instruct them in how to create a secure, long, strong, and easily remembered password like the following:

R4nD0ms7@Pl312eM0/312 is a random staple remover. Good luck identifying that at a glance, or cracking it. But wait you've already memorized the base!

Answer 2

On the surface it seems more secure - but I would be concerned that you might run into issues of people writing the random password down on a post-it and slapping it on the wall next to their computer. You can suggest people use a password manager, but at the end of the day 90% of them will just do what they want.

It could also be made less secure based on your delivery method. If you email them their password then that's obviously a problem because then it's floating around in plain text.

Also - everyone in the company might hate you. In my experience people hate auto generated passwords. This isn't really security related but might be worth considering.

In summary - I'm not sure it's a black and white answer. The passwords themselves will probably be more secure but there are the other issues I mentioned to consider.

Answer 3

Random won't work, if there's an issue with single authentication, move to 2-factor. That way if someone is able to pass the hash, you still have the secondary protection. Long passwords, overly complex passwords, and too frequently changing passwords, will only cause users to A) Save passwords on every device they can use and B) cause them to write it down.

Keep the password policy to something the users can remember, and train them on better password use, but 2-factor is your safe bet.

Remember, if a users is grabbing user hashes, they're already on a compromised system, so random passwords will only work if you're also flushing every system of every user profile after every logoff. That'll annoy users when they have to build profiles for every logon. If you didn't do that, an attacker would still have a window to gain access even with random in use.

2-Factor for the win.

-Chase

Answer 4

If the users are confident that their physical devices are secure, why not use token-based security instead of passwords? You could keep track of tokens and their expirations in a database table. They can start the process of migrating to such a system if you e-mail the user a message which contains a unique and random confirmation URL. When they click on the URL, they get a cryptographically secure token saved to their browser in a cookie or in local storage. That way they don't have to use passwords anymore, and you can generate the tokens with a CSPRNG. For users that don't want to assume that their devices are secure enough, and for users with expired tokens, just e-mail them a confirmation URL again. No passwords necessary.