7

Is it a good idea to expire passwords after a time relative to their complexity? Is it a good way to teach users to use secure passwords? (relevant xkcd: correct horse battery staple)

I'm thinking of giving hints on how to make the password stronger, and displaying the expiration date of the new password while the user is typing it.

EDIT:
There seems to be a lot of answers pointing out that storing the relative difficulty of passwords (or something that hints of it) is insecure. That is true for most systems used today, but it doesn't have to be. If the passwords expire in 1/1000 the time it would take all computers on earth to crack it, it would still be fairly secure. The point of a variable expiration would be to allow less secure passwords, rather than forcing everyone to use one that will be secure until the heat death of the universe. Switching passwords every few years, while being allowed to use a 10-20 character shorter password, is probably a good tradeoff for many people.

It turns out that this security concern isn't even the real issue, as the great people over at Security SE pointed out. From a security perspective, expiring passwords are used to limit the time a compromised password (e.g. from shoulder surfing) can be used. As they point out, if you have access to the hashes, and thus the ability to attack them locally to avoid any rate limiting set up on the site, you probably have enough access to the system to do whatever you want anyway.

Improve this question
3
  • 2
    No, but it would be a good idea to provide the user with some feedback as they type their password to encourage them to choose a more complex password.
    – John
    Jan 10, 2017 at 19:36
  • 1
    The more onerous you make your password rules, the greater the chance users will write down their passwords, thus defeating the object of making them complex.
    – DarrylGodden
    Jan 11, 2017 at 20:48
  • @DarrylGodden passwords on post-it notes are incredibly hard to get to when you don't have physical access, but I get your point :)
    – Filip Haglund
    Apr 12, 2017 at 17:02

8 Answers 8

Reset to default
7

NO

This would be a security risk. You would be storing information about which passwords are less secure.

The fact you had implemented this system would be easily discovered. If hackers acquired your password expiration dates, they could target accounts with the short expiration times.

If a password is not really strong enough, the last thing you want to do is store that information digitally. Better to just make the user enter a strong password.

Improve this answer
0
3

No. All you'll likely be doing is frustrating or confusing users. While it's admirable to encourage good passwords, an expiration date can actually encourage the opposite effect, as users will be likelier to pick simpler passwords. It's tricky to come up with new passwords regularly, and a lot of users will default to bad habits: going from "passw0rd1" to "passw0rd2", for instance. In your particular case, they won't see a longer expiration date as a "reward" for a good password, they'll see it as a punishment regardless.

If you implement password expiration, it should be for one purpose: to limit the damage that can be done in the event of a password breach.

Improve this answer
6
  • Your two paragraphs don't fully agree. Variable expiration date is better at preventing a breach, because you can punish really bad passwords. Cyclic password reuse can be limited, even for similar passwords. I don't see how this would have to mean worse passwords. Of course users would hate it.
    – Filip Haglund
    Jan 10, 2017 at 18:31
  • 2
    @FilipHaglund if a password is really bad, don't punish the user for it, just forbid the password outright. Variable expiration doesn't offer more protection than one standard expiration length. Your goal here is to reward users for good passwords. A password expiration date is not a reward, and no user will see it that way.
    – FirstLastname
    Jan 10, 2017 at 18:59
  • On a more paranoid note, tying password strength to reset length could be a potential vector for attackers. If someone breaches your database, they now know which passwords are weaker and easiest to bruteforce.
    – FirstLastname
    Jan 10, 2017 at 19:16
  • Variable expiration allows the good users to not have to change passwords. Almost all users will dislike an expiration date, but it has its benefits in terms of security (which can be countered by incrementing a number each time or reusing passwords, but you can protect against those too). You'd only see the expiration date, not the strength, so it'd only be an indication of password strength, not a exact metric. You'd at least know which ones are really hard. The whole idea with variable expiration is that you allow passwords to live at most 1/10000 the expected cracking time.
    – Filip Haglund
    Jan 11, 2017 at 0:02
  • If I attacked such a system, I'd go for the longer expiration dates, hoping the system classified a weak password as harder than it is. But if the system doesn't do that, I don't know how you'd get in.
    – Filip Haglund
    Jan 11, 2017 at 0:04
1

I don't see why an expiry time should be linked to password complexity.

You would be dragging out the problem and adding complexity.

At my friends last weekend, I saw the UK Gov have launched a TV ad which advises the public to pick three random words and use that as a password. (I can't find any info on the advert, it must be new.)

You might like to use the same advice :)

Improve this answer
2
  • 1
    the UK gov recommendation helps but only so much. Chances are all three chosen words will be within a set of 5000 words, thus susceptible to dictionary attacks. Still it's better than using passw0rd or pas$$word.
    – Mayo
    Jan 10, 2017 at 16:53
  • That ad you saw is likely derivative of the XKCD comic already linked to in the question. While it was good advice at the time, as @Mayo mentions, these types of passwords are now highly susceptible to dictionary-based attacks (even with substitutions like passw0rd or p@ssword).
    – IT Bear
    Jan 12, 2017 at 0:51
1

No, it would not be a good idea to link the two. What you should do is have passwords expire after a certain length of time and have passwords created after a certain date meet a certain complexity requirement. That way all of your users will eventually have more secure passwords If you want more info on how to do this, I'd suggest looking into the CompTIA Security+ certification and its study materials. They go into the topic of password complexity and expiry dates specifically in some of the chapters.

However, if you have users where the password is currently not complex enough, I would change your password requirements to be more complex and then give those accounts notification that they need to update their password to meet complexity requirements. Basically, make the users have a more complex password so you wouldn't have the need to link it to expiry times.

Improve this answer
1
  • "However, if you have users where the password is currently not complex enough" If you are able to identity these users, your system is about as secure as a sieve. Fix that first.
    – Aron
    Jan 12, 2017 at 10:18
1

I have worked at an organization that had such a process where you had to update your password every 30 days in order to access the system. Of course, the objective of the management to get the employees to do so was to make the system more secure, but then it hardly served any purpose.

Well, keeping track of one password with its special character, numeral and uppercase mandate was already sufficiently difficult. And now you want the user to change it to a new one, while he/she has taken the past 29 days to remember their own password properly, and that too can't be the same as the past five passwords?! What kind of process on Earth is this?!

So the employees would hack the process apart. The reason behind this is that humans (at least, most of them) are lazy thinkers, i.e., they only think where the effort is due, or think in a fashion that would consume the least effort by default.

This is the kind of password they would create: Password@01

Replace Password with the word of your choice and keep updating the last two digits with the month number, for example, for the month of June and my password of choice as Foobar, I would create a password as Foobar@06. And this was the story of anywhere I went across the country. How do I know? Well, we had to exchange password sometimes in case some urgent need arrived and the concerned person was not at their desk.

Hence, the process was a sheer waste of the employees' and the developers' effort. Instead a 2-step or 2-factor authentication would have genuinely improved the security of the system if one were so inclined.

TL;DR Password rotation hardly makes any difference. People somehow find a way around it. Rather use a 2-step authentication to improve security.

Improve this answer
1

No

Making your passwords expire will ensure that most of your users will employ weaker passwords.

https://www.schneier.com/blog/archives/2016/08/frequent_passwo.html

A user can come up with a "new" weak password every single day if he needs to. So shortening the usage window for a bad password is irrelevant as long as the usage window of a good password is still too short for users to feel it's worth learning it.

Also XKCD's trick has been adapted to by crackers. It is no longer sound advice. (Well if your alternative is 'swordfish' then 'stupid swordfish named nemo" IS an improvement.)

Set a decent lower bar, ensure a high ceiling by allowing long passwords with as many character sets as you can and give the user an indication of how secure his password is.

Improve this answer
1

Meaningful gamification of password creation

Real experience innovation! This is definitely a proposal worth researching. Password strength indicators made some progress with increasing password quality, as noted in this article:

So, password meters are not a reliable guide to how likely it is that your password will be cracked but they do seem to nudge people in the direction of creating stronger passwords in general.

IOW, it's a psychological factor. Whether the password is really hard to crack is up for debate, but it made people think about quality.

Unfortunately, users are rarely as concerned about security as you are. Password expiration, on the other hand, is something every user dreads. Visualizing an increasing expiration date with strength addresses a real user concern. I'd be surprised if that delightful benefit didn't drive up password strength noticeably.

Security risk?

As to the concern others have mentioned about storing password strength, this isn't a real issue. You can hash that just as well as you can hash passwords. Once a hacker cracks the hash, all bets are off anyway. At that point, it's more important to ensure high quality monitoring and alerting that allows your IT team to respond to breaches quickly.

One caveat

As the quote above points out, it's really hard to properly gauge a password's crack-resistance level. If yours isn't exceptionally good, you could be handing out long expiration dates for insecure passwords. Just make sure you get a good one. Dropbox worked hard to improve theirs. There are many libraries out there. Just do your homework.

Improve this answer
-1

Why not just force user to use long passwords from the get go then the only time yo actually need to expire the passwords are when your servers has been compromised. Also adding a warning to the affect of " do not reuse passwords" might be a good idea.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.