3 ms·
If your password is compromised, you've already lost. Since password rotation policies incentivize weak passwords, they are more likely to result in a compromi
by nitrogen 10y ago
If your password is compromised, you've already lost. Since password rotation policies incentivize weak passwords, they are more likely to result in a compromised password. Thus, password rotation with weak passwords is not better than a single strong password that is never rotated.
- phire 10y agoNow that I think about it "Don't worry about detecting attackers, they will get kicked out when we next rotate passwords" is not an attitude you want anyone to develop.
- nitrogen 10y agoPlus, chances are pretty good that if they compromised one password undetected, they can compromise the next one in the same way (spear phishing, malware, etc.).