News for hackers. Stuff that matters.
Re:Microsoft says mandatory password changing is “ancient an... by solatic on Monday April 19, 2021 @01:07PM (#26865184)
> Experiments have shown that users do not choose a new independent password; rather, they choose an update of the old one.

Such experiments clearly do not introduce the use of password managers which promote the generation of long passwords with high entropy.

Specifically in the case of master login passwords, where the usage of a password manager isn't feasible (like Active Directory and Windows logins), this may be the case. And it still requires that the domain forbid PIN/biometric logins and thus result in people complaining about entering long passwords with entropy each time.

Re:Microsoft says mandatory password changing is “ancient an... by teekert on Monday April 19, 2021 @01:17PM (#26865335)
If only I could use my pw manager at the windows login prompt.
Re:Microsoft says mandatory password changing is “ancient an... by jackson1442 on Monday April 19, 2021 @01:29PM (#26865517)
Exactly. My university requires a yearly password update. I have to manually enter my password to log into computers, print release stations, a billion domains that just use an LDAP connector instead of our Shibboleth page, servers after home directory wipes, etc.

My password needs to be something I can quickly type, so I just use the same one (a strong, multiple-word passphrase) and add its validity period to the end.

This actually makes hitting arbitrary password requirements easy too; make one word capitalized (or one lowercased), separate each with an allowed symbol, and the validity period is numeric so it passes just about every security check while being easy to type and remember.

Re:Microsoft says mandatory password changing is “ancient an... by syntheticnature on Monday April 19, 2021 @01:33PM (#26865589)
Indeed, my work login password, with regular rotation requirements, has been dropping entropy by a few bits each time it comes up for renewal. I work to make my work passwords as different as I can, but that password doesn't get used enough for me to trivially remember it, and it can't be offloaded to a password manager easily.
Re:Microsoft says mandatory password changing is “ancient an... by cyberpunk on Monday April 19, 2021 @01:41PM (#26865724)
I store a 32 char random string on a yubikey and have it setup so a “long press” on it enters it, works pretty well...
Re:Microsoft says mandatory password changing is “ancient an... by Godel_unicode on Monday April 19, 2021 @02:15PM (#26866171)
I'm curious why you use this and not the Windows integration with yubikey?

https://www.yubico.com/products/computer-login-tools/

Re:Microsoft says mandatory password changing is “ancient an... by cyberpunk on Monday April 19, 2021 @04:17PM (#26867472)
I'm on a Mac and couldn't be arsed setting it up properly ;) It's fairly easy to put a static OTP on two keys incase I lose one also instead of trying to register two with the OS.

Also I can use it for various other things (like password manager secret etc) which don't support yubis out of the box.

Re:Microsoft says mandatory password changing is “ancient an... by Larrikin on Monday April 19, 2021 @02:17PM (#26866195)
1password syncs to your phone. I can count on one hand the number of passwords I actually have memorized
Re:Microsoft says mandatory password changing is “ancient an... by benhurmarcel on Monday April 19, 2021 @04:18PM (#26867485)
I use 1password for everything, but I need to type my professional Windows password every time I log in, I'm not copying a password from my phone every time I come back from the bathroom.
Re:Microsoft says mandatory password changing is “ancient an... by kevin_thibedeau on Monday April 19, 2021 @02:28PM (#26866326)
They've allowed third party fingerprint scanners to handle login so the APIs are there to do it.
Re:Microsoft says mandatory password changing is “ancient an... by michaelcampbell on Monday April 19, 2021 @02:46PM (#26866508)
Indeed. I use a passphrase, or a series of typeable but random words in the 'correcthorsebatterystaple' vein for that.
Re:Microsoft says mandatory password changing is “ancient an... by iso1631 on Monday April 19, 2021 @01:32PM (#26865573)
I used my PW generated password on a site earlier, the site refused to accept it. 2^102 bit aren't enough (18 from 52 random upper/lower characters) aren't accepted, but P@55word was fine.
Re:Microsoft says mandatory password changing is “ancient an... by andromeduck on Monday April 19, 2021 @02:13PM (#26866147)
Password must between 6-12 characters...

rips hair out

Re:Microsoft says mandatory password changing is “ancient an... by ben0x539 on Monday April 19, 2021 @04:57PM (#26867898)
This is _specifically_ the one place where we require a rotating password too, so I think those experiments are informative.