5

I work at a healthcare tech start up which is pretty strict about its login guidelines, largely because protecting patient and provider info is such a vital need in this industry. But while our strictness serves an important need, it can cause a fair amount of headaches for our providers. The source of much of this frustration is the fact that providers, when changing their passwords, are not allowed to reuse any of their last 12 passwords. And they're having difficulty remembering their old passwords, and there's no secure/systematic way of providing that info to them. What's worse is that they're also required to change their passwords every 90 days. So between the cognitive load required to remember all of their recent passwords and the frequency with which they need to update their passwords, providers are getting fed up, and are either abandoning the platform in frustration or relying heavily on customer support, who are inundated with requests to change providers' passwords for them.

That said, does anyone have any experience with the "previous password" problem? And if so, what approaches have you used to mitigate it? Thanks for your help!

(and an FYI, I asked my security team if there was any wiggle room on the frequency of the pw change, as well as the change criteria, but they said its pretty much set in stone)

  • Oh wow, that's... pretty unfortunate. Do you restrict how frequently they can reset their password? – maxathousand Jun 19 at 20:49
  • Hey @maxathousand we don't. They're required to reset them every 90 days – Conor Jun 19 at 20:55
  • Would it be acceptable for them to stay logged in on their own machines until they're forced to reset the passwords, or are they required to log in for each session with your service? – maxathousand Jun 19 at 21:09
  • Nah, all our providers are automatically logged out after 30 min of inactivity to reduce security liability, so unless their separate sessions are within that 30 min timeframe, then yeah, they technically do have to log in for each session :/ – Conor Jun 19 at 21:35
  • What options do you have? Unless users have access to a password manager there is no way to reduce cognitive load. But if it is possible to look at other security options, you should definitely do that. Btw. are periodic password resets really that safe? I can imagine that people write down their password on post-it papers and leave it on the desk. – jazZRo Jun 20 at 11:47
8

Switch to two-factor authentication and reduce the frequency of forced password changes.

BTW, your system storing their last 12 passwords, even encrypted, is a major security problem. A hacker who steals and figures out how to decrypt them will have 12 guesses for all of their other accounts online.

  • 1
    hey @stacy H, thanks for writing. I talked to the security team and I guess they're exploring 2-factor as a solution, which is good, but apparently it'll be a challenge to set up the API. Still, anything's better than the current situation. Thanks again! – Conor Jun 20 at 19:03
  • @Stacy If they're doing it right, the passwords (current and previous) wouldn't be stored encrypted (i.e. reversible), but they would be storing (appropriately generated) hashes of the passwords. Hashes are one-way functions: you can check if the hash of a newly-entered password matches the hash of the current password (or the hashes of any previous password) but you cannot get a password back from the hash. – TripeHound Jun 24 at 11:34
  • 1
    Should also be using salt to prevent use of Rainbow tables. – 習約塔 Jun 24 at 22:18
  • @習約塔 That was part of my "appropriately generated" without going into all the gory details. – TripeHound Jun 24 at 22:43
  • @TripeHound You and I know that, but StacyH might not have. I also wonder if OP's "security team" does as well. – 習約塔 Jun 24 at 22:48
7

The NIST has a policy for passwords that can be helpful to answer your question. First you should talk again to your security team. The NIST has deleted their policy to force users change their password periodically. The NIST Digital Identity Guidelines FAQ states:

Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.

Then you should also checkout OWASP as a source for best practices in developing secure software systems. For example, you could try to move the users to use passphrases that are easier to memorize, instead of passwords (perhaps with complex special character patterns).

  • Thanks @torben, these resources are super helpful – Conor Jun 20 at 19:03
4

Some options to consider:

  • Two-factor authentication. I'm not a fan, but it might be better than what you have if it would reduce the frequency of password changes. It doesn't make much sense to require two-factor every 30-minutes from the same location, so consider limiting its use to once daily or upon IP/location changes. Also, beware of SIM swap scams.

  • Block access from "foreign" IP addresses. Hospital employees are unlikely to access records from outside the city. Even less likely to access records from multiple locations at once. This would improve security with zero user intervention.

  • Dongles, such as ID cards. They can be revoked and provisioned remotely. They can be used to control physical access to restricted areas via door locks. Nearly everyone has seen key cards in movies or TV shows. Even those who haven't can probably figure it out.

  • Diceware-style passwords. Easier to remember and more secure than inane password rules that are often required.

    xkcd: Password Strength


What problem is the "security" team trying to solve by requiring password changes every three months and storing three-years worth of old passwords?

  • How does it prevent users from writing passwords on sticky notes? Could users be more likely to write passwords down because of "the cognitive load required to remember all of their recent passwords and the frequency with which they need to update their passwords"?

  • How does it protect users from phishing attacks? Could it make users more susceptible to such attacks because they are "relying heavily on customer support"?

  • How does it prevent compromised accounts from being used during the three-month period that the current password is active?

  • NIST recommends against arbitrary, periodic password changes, as Torben notes.

Is the 30-minute time out...

  • Necessary? Some data may need to be available despite user activity, such as cardiac telemetry. (Would you really care if a stranger could see your heart rhythm if it increases your chances of surviving a heart attack?)

  • Sufficient? Thirty minutes is more than long enough for an unauthorized person to access account information. (Happens in movies all the time.)

1

What you are talking about is a big headache, so, for this reason, your startup needs to think smarter. Actually, I've been doing research on how this process can be done fast and intuitive.

I have some suggestions can be applied on personal bases and the other options need 3rd party apps to be applied from your hi-tech company to secure data:

1- Create a phrase like "I hope the Giants will win the World Series in 2016!" Then, take the initials of each word and all numbers and symbols to create your password. So, that phrase would result in this: IhtGwwtWSi2016! In case the company decided not to invest in new options.

2- Enable two-step-verification Like in most known vendors like Google, Apple, Facebook, etc. But still you need to invent a new password

Check this example from Yahoo: When you click on Account Security you enable two-step verification. Then sliding it to the On position will bring up a prompt asking you for your phone number. Enter your number, then click either Send SMS or Call Me in order to receive a confirmation code. Enter the code when you receive it, and you're done.

enter image description here

3- Password Generator - Which I Recommend it personally - Is another way through using 3rd party application in order to generate a friendly password. By the way, this feature is also available in most of the browsers like Safari, and Firefox.

How it works:

1- The Administrator Guy, though using a special tool to generate Reset password Email to all employees every 90 days, when the employee opens the email he uses to click on that link embedded within the email to navigate to a Reset Password Page. And the random password is already placed in place, so the employee doesn't need to create one. and this password is dedicated to that person.

THEN to add a new layer of security they can do the following:

A- Either by sending a security code to their mobile to enter it.

B- Or using a QR service when you scan it using your mobile you are successfully entering the system FINALLY! :)

enter image description here

Such as http://saaspass.com You can check it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.