Meg

The login system for #yeg transit's smart card website makes you reset your password after 90 days of not logging in.

They also have auto reload so you rarely need to login.

So uh. I guess they accidentally stumbled on a very contrived system of logging in with one time passwords, except you have to generate them yourself?

(Edited to remove incorrect comment about needing to tap off - the policy changed at some point)

Jul 15, 2023 at 12:13amWeb
Show threadMegJul 15, 2023
Repeat after me: forced password cycling reduces password security. It is bad. Do not make people pre-emptively change their passwords.
Show threadMegJul 15, 2023
Do you want people to use "password5" as their password? Because this is how you get people to use "password5" as their password.
Show threadsiriusfox πŸ“‘β‡„πŸš€β‡†πŸ›°οΈJul 15, 2023
@megmac I’m told in the various military forces they rotate on 30 day intervals. I weep for our security theater.
Show threadChris BohnJul 15, 2023

@siriusfox @megmac The really **AWESOME** thing [1] was in 2008 when I discovered this happened on website that you for an event (PCS) that occurs only every few years, and when you do it's typically 60-90 days between uses.

CAC authentication was a pain for many things, but at least it solved that problem.

[1] sorry about that -- I typed "awesome" when I meant "awful"

Show threadQeruiemJul 15, 2023
@siriusfox @megmac They do that at my current customer (not military). My current password ends with 13. That’s how I know I’ve been there for over a year.
Show threadI am Jack's Lost 404Jul 15, 2023

@megmac

90 days later: password6

Show threadBornachJul 15, 2023

@float13 @megmac

This is exactly what I do but with the added step of hashing the password through
https://passwordmaker.org/passwordmaker.html

Takes me a whole day to invent a ridiculous story I can use as a mnemonic device for the gibberish that the hash function spits out

PasswordMaker. One Password To Rule Them All.β„’

Show threadAmelia Bellamy-Royds Jul 15, 2023

@megmac Thanks to reverse-chronological scroll, I saw these posts before I saw the first one, and my immediate thought was: someone had to top up their arc card.

It's just so beyond absurd to use 3-month password expiry on a site people are only going to use a few times a year.

Show threadGuitarKatJul 15, 2023
@AmeliasBrain @megmac Wow that is terrible. F. lol good job ets! πŸ‘
Show threadAndrew Steadman Jul 15, 2023
@AmeliasBrain @megmac wtf? Seriously?
Show threadanniethebruceJul 15, 2023

@megmac There are some systems where I have passswords like that, and password6, password7, etc.

Systems I can consistently use my own computers/phone to access and have the password saved, I don't, but there are systems I do that with. Only so many silly phrases I can keep in mind at any given time.

Show threadAidanJul 15, 2023
@anniethebruce @megmac noted.
Show threadskribe πŸ‡ΊπŸ‡¦ Jul 15, 2023
@megmac at the company I used to work at, all the computers had password1 as the password. We weren't allowed to change them. It was so the 'techs' could access all of the computers or some dumb shit.
Show threadNiclas HedhmanJul 15, 2023

@megmac
Correction; password$6

Need a non-alpha-numeric character.πŸ™‚

Show threadNiclas HedhmanJul 15, 2023

@megmac I once (2010-2016) worked at a BigCorp that had the 90 days rule, so when I left I had the equivalent of password%25, and yet after each vacation I needed to request a password reset from Admin, since I couldn't recall if it was 12, 13, 14 or around there (only got 3 tries).

I am surprised that IETF hasn't worked out a personal web way of having SSH keys instead, could be fairly hidden to average users. Sounds like a no-brainer to me.

Show threadMika on rails Jul 16, 2023
@megmac the same way that insanely specific password requirements just result passwords written down on post it notes on the monitor
Show threadDerek McEachernJul 16, 2023

@megmac I work for a large corporation and we have 90 day forced rotation, however we don't get to choose our passwords. We have to pick from a generated list so there is no password reuse and no simple passwords.

I'm convinced we do this because we have very old systems that have length limitations so even the generated passwords don't have much entropy.

Show threadMarcos HuertaJul 15, 2023
@megmac I once frustratedly emailed off NIST guidance to some rando customer service email address I was so tilted. (T-mobile maybe?)
Show threadstandevJul 15, 2023
@marcoshuerta @megmac Last I checked PCI-DSS is still living in the past, which is the root of the problem.
Show threadtired blipJul 15, 2023
@megmac I also despise "your password cannot be any of your prior passwords", mostly because after cycling through the first 5 passwords I have any hope of memorizing, I basically end up using Reset Password as the login button every time I access that site from then on. There's important things that I now *only* access via the Reset Password button, because I've long since given up trying to remember what arcane, unique thing I had to feed the damn thing last time.
Show threadDeb4+ aka Deborah DT πŸ³οΈβ€πŸŒˆπŸ³οΈβ€βš§οΈJul 15, 2023
@klardotsh @megmac why are you hoping to remember passwords??
Show threadpfriedmaJul 15, 2023
@megmac
Also, forcing arbitrary password rotation in absence of evidence of a password compromise SHOULD NOT be done according to NIST-800-63b 5.1.1.2
Show threadRAMΞNJVNKIΞ🍜Jul 15, 2023

@pfriedma @megmac All it does is encourage password incrementing.

If you were going to try to hack someone't employee password anywhere, a good piece of information would be how long they have been there, because you can probably multiply the number of years by 4 and get close to whatever number they have in their password.

Show threadAlerta! Alerta!Jul 15, 2023
@pfriedma @megmac Damned... I checked the thread looking for exactly THIS and didn't see it... 🀦
Show threadBen StokmanJul 15, 2023
@megmac relevant article I wrote about this: https://benstokman.me/blog/the-two-rules-for-passwords/
The Two Rules for Passwords - Ben Stokman

Show threadrobπŸ•ŠοΈπŸ‡ΊπŸ‡¦πŸŒπŸŒŽπŸŒβœŠJul 15, 2023
@megmac couldnt agree more
Show threadDCoder πŸ‡±πŸ‡Ήβ€πŸ‡ΊπŸ‡¦Jul 15, 2023
@megmac
my workplace never had this policy, but now we got ISO 27001 certified and our new IT admins started enforcing this policy β€œbecause Microsoft’s own advice to skip this rule only applies if you implement other security measures we are too cheap to implement, lol”.
Show threadMartin GleadowJul 15, 2023
@dcoderlt @megmac implementing MS MFA is painless. And I've sailed through ISO27001 audits many times without enforced password rotation, even before NIST and NCSC guidance came out
Show threadDCoder πŸ‡±πŸ‡Ήβ€πŸ‡ΊπŸ‡¦Jul 15, 2023
@mgleadow
I know, I was just venting :)
Show threadCameron TalleyJul 15, 2023
@megmac I recently moved to a job where you have to change then every 2 months and it’s maddening.
Show threadKegan MyersJul 15, 2023

@megmac Even NIST is on board with this (NIST Special Publication 800-63B, 5.1.2):

Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets. Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.

Show threadSebJul 15, 2023
@megmac Especially when it’s for something you only log into at about the same frequency the password needs to be reset.
Show threadCiggy Bringer of SmokeJul 15, 2023
@megmac also, two costs are imposed - those who use uncreative staples and are vulnerable, and those who utilize password reset systems because they dont actually beat the clock to change.
Show threaddevoluteJul 15, 2023
@megmac How about if I bill my clients for every single technical support interaction and doing this across their company triggers more tech support interactions? #chaoticEvil #agencyLife
Show threadalisterJul 15, 2023
@megmac i wish more people knew this
Show threadMartin GleadowJul 15, 2023
@megmac had this conversation with an auditor just this week!
Show threadLeonardo Ferreira FontenelleJul 15, 2023
@megmac No one I know really picks new passwords every time. We cycle between two (or even four, if needed) minor variations of the same password.
Show threadvadergbJul 15, 2023
@megmac @thatKomputerKat I find teachers and support staff will write them down, some even on notes their IT equipment. They also rely on browsers and phones hold their password but have a crisis if they loose access to their devices.
Show threadBrian Pierce MDJul 15, 2023

@megmac

NIST rescinded the recommendation to routinely change passwords years ago and the biggest hospital network here in #maine still requires them.

"...Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically)... "

https://pages.nist.gov/800-63-3/sp800-63b.html

NIST Special Publication 800-63B

NIST Special Publication 800-63B

Show threadTHIS ACCOUNT HAS MOVEDJul 15, 2023
@megmac this is so true and IT departments in dumb corporations get it so wrong.
Show threadXavier LevauxJul 15, 2023
@megmac Even Microsoft is calling the practice β€œan ancient and obsolete mitigation of very low value.” https://duo.com/decipher/microsoft-will-no-longer-recommend-forcing-periodic-password-changes#:~:text=Users%20who%20hate%20having%20to,recommendation%20from%20its%20security%20recommendations.
Microsoft Will No Longer Recommend Forcing Periodic Password Changes

Users who hate having to change their Windows passwords every 60 days can rejoice: Microsoft now agrees that there is no point to forced password changes and will be removing that recommendation from its security recommendations.

Decipher
Show threadAlerta! Alerta!Jul 15, 2023

@megmac https://pages.nist.gov/800-63-3/sp800-63b.html

Section 5.1.1.2

> ...Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically)...

But what does the NIST know....

NIST Special Publication 800-63B

NIST Special Publication 800-63B

Show threadShewstone PublishingJul 15, 2023
@megmac The very US government standard that spread the idea of rotating passwords, NIST SP 800-63, was updated in 2017 to say "forced password changes are bad for security." Yet here we are 6 years later still fighting to convince IT departments to FOLLOW THE CURRENT VERSION OF THE INDUSTRY STANDARD!
Show threadBytebro πŸ‡¬πŸ‡§ πŸ‡ΊπŸ‡¦ πŸ‡¬πŸ‡±Jul 15, 2023
@megmac True. At my workplace we *must* change them every two months. Therefore everyone uses permutations of 'this year' and 'this month'. Not even slightly secure.
Show threadsmartwatermelon Jul 15, 2023
@megmac @leigh could you please tell the FedRAMP and PCI people this?
Show threadeternaltyroJul 16, 2023

@megmac Security at the expense of user experience comes at the expense of security.

Alternatively:

Security at the expense of convenience comes at the expense of security.

Show threadTrash PandaJul 16, 2023
@megmac
Can you explain why? Not to argue, I am genuinely curious
Show threadGayCookie Jul 16, 2023
@megmac haha imagine every website does this, you just plan an entire day in your calander just to change passwords haha
Show threadnorthern dude πŸ’›πŸ’™Jul 16, 2023
@megmac it can be good if you forbid passwords with too short minimal edit distance. But no one does those checks 🀣
Show threadAndrew at MysticBearPawJul 16, 2023
@megmac Yes! Yes! Yes! The worst data breaches are hacked databases. Forcing users to change passwords doesn't do anything to prevent that.
Show threadFubaroqueJul 16, 2023
@megmac As if everybody (and I mean everybody with at least two brain cells) didn’t see this from the moment they (Microsoft) first started to force people to periodically change their passwords. #sigh #imlookingatyou #mydearemployer πŸ₯΄ πŸ€”
Show threadRickJul 16, 2023
@megmac @nicklockwood And stop with the security questions!
Show threadAntifascist Atha AhuluheluwJul 17, 2023
@megmac Amen!
Show threadTony GhostbriteJul 17, 2023
@megmac I do contract tech support for a government organization and they force employees to reset their password every 90 days. They also require their employees to use security cards that do not interact with the password system in any way. Still, they will get locked out if they don't update their never-used password.
Show threadTimo EwaldsJul 15, 2023
@megmac does standard contactless not work? Why do you need a transit specific smart card at all?
Show threadMegJul 15, 2023

@tewalds I've never been on a transit system where you could just use credit card tap to pay a bus fare on the bus? Is that how it works in London?

(Main other transit systems I've used with fare cards are the Bay area, New York (think they've changed it since I was there though), Calgary, and Stockholm)

Show threadTimo EwaldsJul 15, 2023
@megmac yup, I just pay with my phone. They still make transit specific cards, but few people use them these days. It's easier and often cheaper to use your own credit or debit card. Admittedly you can login to their system to correct charges (eg in case you failed to tap in/out somewhere), so it won't actually fix your password complaint, but I haven't done that in years.
Show threadTimo EwaldsJul 15, 2023
@megmac It seems paying with normal contactless is starting to become common, or at least common knowledge. https://art19.com/shows/the-urbanist-agenda/episodes/d6c84a5e-4a19-43a9-9f49-659e50a74694
Opening Transit Payments (with Urban Caffeine)

Paying for public transit is way too complicated, especially if you're an occasional user or tourist. Can open payments make this process easier for everyone? In this conversation, Jason from Not Just Bikes and Thea from Urban Caffeine discuss recent developments in open payments. If we're going to charge for public transit (which is a whole other conversation), how should payments be collected? Why are we still using obtuse way s of paying when credit cards and debit cards exist? References and further reading: https://www.brookings.edu/research/how-better-payment-systems-can-improve-public-transportation/ https://www.bytemark.co/bytes-of-knowledge/what-are-open-loop-payments-in-public-transit https://www.intelligenttransport.com/transport-articles/78096/open-loop-payments-united-states/ Get the next episode one week early and support this podcast by signing up to Nebula: https://nebula.tv/agenda Not Just Bikes: https://youtube.com/@notjusbikes Urban Caffeine: https://youtube.com/@urbancaffeine

ART19
Show threadMegJul 15, 2023

@tewalds I assume smaller systems like Edmonton's don't want the overhead of cc transaction fees on a lot of small fares, but that doesn't explain most of the bigger cities I've used lol.

The Edmonton system is also very new, and they don't even have a phone app yet so you do need a physical card. Really hoping they at least fix that.

But really they just shouldn't make you rotate your password, that's definitely the easier fix heh