Yubikey to replace 90 day password changes

Changing passwords every 90 days is absurd. If places like amazon dont require us to do it why should ZC? There are much more better options to harden servers than changing passwords every 90 days. Servers without firewalls or modsecurity enabled would be compromised with or without changing passwords every 90 days.

I would like to see us to have the option of using Yubikey (or Googles Titan) instead of changing all of our passwords every 90 days. I have more than a dozen websites all with staggered 90 day expirations. Crazy and aggravating. Magento shopping cart doesnt have any such requirements and they are owned by ebay.

Its time to throw away this archaic method of hardening servers, even if it means using a password that is a sentence instead of a word.

Ask any mathematician if changing passwords world wide every 90 days would reduce the number of intrusions. If their answer is no, then we shouldnt be doing it.

And I have said this before in this forum. My work around for different passwords is to simply use the date as a prefix to my normal password. Before, my password was 9 digits consisting of number, letters and special symbols. Now thanks to this new and improved 90 password expiration, with my long date prefix, I have a simple password unlike my old 9 digit password. So you tell me, is my site more secure or less secure? I say less secure. ie date+6 digit pw (date=Q1,Q2,Q3.Q4)

pixelpadre:

Changing passwords every 90 days is absurd.

This is a PCI compliance measure which you can disable if you wish. It wasn't Zen Cart's idea - it's a PCI rule.

I dont think that is general knowledge in this forum. I would disable it if I knew how. And so would most everyone else. Why is it that Magento owned by ebay, does not have the same requirements.?

Magento was purchased by Adobe June 2018 and Magento does not do a PCI compliance assessment of the entire Magento eCommerce platform. I can only find the certification for the Magento payment bridge, which is the only part they ever certified, but it expired in OCT 2016. SO there is your answer, Magento has never gone through having the entire application certified like Zen Cart did so they didn't have to worry about that... That is a problem for people implementing magento as their ecommerce solution to worry about.

pixelpadre:

I dont think that is general knowledge in this forum. I would disable it if I knew how.

Admin->Configuration->My Store->PA-DSS Strong Password Rules Enforced?

Set this to False. This feature has been available since 1.5.4.

So is PCI certification sort of like having the "Real" seal on packaged diary products? Not really meaningful but makes soccer moms sleep better at night?

Great, Great news. TYJ

barco57:

Magento was purchased by Adobe June 2018 and Magento does not do a PCI compliance assessment of the entire Magento eCommerce platform. I can only find the certification for the Magento payment bridge, which is the only part they ever certified, but it expired in OCT 2016. SO there is your answer, Magento has never gone through having the entire application certified like Zen Cart did so they didn't have to worry about that... That is a problem for people implementing magento as their ecommerce solution to worry about.

We have gotten off track. My request was implementation/integration of yubikey, or some other 2FA method to harden server. That would be a reasonable easy approach that would eliminate 100 percent of any brut force attacks.

pixelpadre:

We have gotten off track. My request was implementation/integration of yubikey, or some other 2FA method to harden server. That would be a reasonable easy approach that would eliminate 100 percent of any brut force attacks.

The "hooks" have been built-in for a while. It just takes someone to create the code for the particular 2fa device.

While not quite what you are wanting, we use yubikey to control our password manager, LastPass. No problem with password changes every 90 days using the LastPass password generator.

Password Managers FTW!

swguy:

Password Managers FTW!

I dont see that catching on. That looks like putting all of your eggs in one basket. I dont want my passwords tied to a monthly payment. A dongle is what I want.

pixelpadre:

I dont see that catching on. That looks like putting all of your eggs in one basket. I dont want my passwords tied to a monthly payment. A dongle is what I want.

LastPass premium with YubiKey (or nearly any other flavor of dongle). $12-$24/year is pretty cheap.

I dont need lastpass to use yubikey. ZC should have a store where they can sell Yubikeys. Hint Hint Dr.Byte.

pixelpadre:

I dont need lastpass to use yubikey. ZC should have a store where they can sell Yubikeys. Hint Hint Dr.Byte.

No, but it sure makes keeping track of all the cryptic 20 character passwords easy.