this post was submitted on 27 Jul 2023
875 points (98.2% liked)
Memes
45741 readers
1203 users here now
Rules:
- Be civil and nice.
- Try not to excessively repost, as a rule of thumb, wait at least 2 months to do it if you have to.
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
And despite security recommendations, too many IT depts still force password resets every 90 days...
And people confronted with this change their password from "p@55w0rd!1" to "p@55w0rd@2". Yep extra-secure!
At some point most security recommendations are self-defeating.
@278 and going strong, across 7 companies. One time, just to mix things up, I used an exclamation mark instead. It was exhilerating. /s
I work in the IT section of a bank and they force a change every 30 days and can only have an 8 character password no more no less 🙃
Seems like a job for Bobby tables
Hey, how do you know my password?
Ideally we'd all use password managers, but I'm aware 99% of peoole don't. Even with one, it's frankly a pain in the butt to be nagged about changing it. "Man, my passwords are 20 random characters. I don't need yo reset ot unless you've had a breach."
Password managers are great. Until you need to log in with a new device or a device that's not yours.
Oh, the sixteen digit randomly generated password with two alphanumeric characters in it? Sure I remember that.
You gotta use word-based passcodes instead of random jibberish. That way you can quickly read it from your phone and type it in.
A job I quit about 6mos ago required monthly changes. It was awful. And, yes, it absolutely led to me just incrementing a number at the end. I knew it was time to quit when I was about to hit double digit numbers.
you're saying not to hold a job for more than 10 months?
It was a joke.
But also, holding a shitty toxic job for 10mos took a mental health toll.
But also, I don't know, in some cases that might be good advice. Since 2020 I've changed jobs every 6-10mos and I'm making triple what I made in 2019, so that's nice.
Some IT guys have caught on to this and require 2 digits difference.
So "ThisJobSucks#11" becomes "ThisJobSucks#22"
How would they know how many digits changed? They don't store the password in cleartext.
Right?
...
You could take the old password, change one or two letters and compare the hash to the hash of the new password?
That's the point though.
You're not supposed to have the old password. If you had the old password you could just compare it to the new password.
The only way you can do it is to take the new password and make a hash for every possible single-character variation and compare them all to the old hash
Sorry, that's what I meant as well :) Came out upside down when I wrote. We used to figure out shitty ISP router passwords this way by having a table of common passwords and their hashes.
No you don't need to store anything in clear text to check password parameters
Well they don't need to store it to a drive. You just entered your old password in order to login and authorise your password change.
It'll still be in memory against your session.
Used to have monthly changes for a Microsoft account. When trying to change, it said "You used this password 6 months ago, please use another", besides the "passwords needs to be at least this different" message. Clearly they are storing them, not sure if they're stored cleartext or they're decrypting them on the fly somehow
You should not be able to decrypt a password, passwords aren't encrypted but hashed, they would be insecure would they be encrypted.
Hashing differs from encryption in that it is irreversible, because two or more strings might result in the same hash if the hashing function is applied to them (hashing is not injective).
But since your password will always yield the same hash you can compare the two hashes and if they are equal you are considered authenticated. If you try to log in with a different password (or even the hash of the correct password) then it will produce a different hash resulting in a failed authentication attempt
The way crackers get a password if they have the hash is by guessing pw candidates and using the hash function on them, if its the same as the hash they have they found the/a valid password. The guessing can be quite involved and with enough time and data about a victim often 12-13 digit passwords with special characters and all can be cracked - If the victim used a somewhat mnemonic pw that is. Generated pws from a password safe are much safer (but usually also longer).
In your case I suspect MS was storing a history of hashes which is not advisable as it gives potential crackers more to work with, but its way less bad then storing plain text or encrypting passwords
{Sitename}+{SaLt}+{yymmdd of password change} easy peasy
I college we had to change our password every semester. Guess who added the semester number onto the end of their password. Hint: everyone.
Same as a government job that required monthly password changes. Well, at least those people had more security than the post-it note on the monitor people
NavyExchange!(ddmm of password change) for as long as I worked there, it was really only to use a register though, I had nothing compromising behind the password lock.
It could be for contractual or for insurance reasons. We have some contracts with government agencies that require it, and our cyberinsurance also does. Even though NIST has been recommending for years to do long passphrase + MFA and no reset unless you suspect compromise.
So yeah, the reason behind this might not be just plain incompetence.