5 ms·

> "...if they have already breached the password file, cracked it, and come back after the rotation period..." Suppose it will take 100 years to crack your str

• kuschku 9y ago
  Unless the hackers simply modify the service itself, and log every password a user inputs to their server. And tada, they got your password.
  • ribosometronome 9y ago
    If the hackers have compromised the service to the point they are able to manipulate the service unnoticed, isn't the horse already a little out of the barn?
    • kuschku 9y ago
      Sure, but this is a common issue, and hackers getting full control over servers is a common issue and the source of many credit card leaks.
      • dsacco 9y ago
        Yes but...password rotation doesn’t defend against that case either...so it’s irrelevant.
        • kuschku 9y ago
          Rotating credentials prevents them from being used for a longer time after they've been stolen. This is the sole reason why Let's Encrypt does 30-day certificates, and why the session tokens in OIDC are usually a few minutes at most. The only one that's using a session token without invalidation time, forever, is Uber, and that was heavily criticized last time on HN. And now, everyone's apparently in support of using the same password as login token for decades, never changing it.
          • dsacco 9y ago
            You’re jumping all over the place. Passwords != session tokens != certificates. Passwords are a form of access control. I repeat: a strong password cannot be brute forced for billions of years. Even with technological advancements, most strong passwords are well over what’s required to literally be safe for a lifetime. Certificates are not a form of access control, like I explained in my other response to you. They are a form of cryptographic authentication. Digital signatures cannot be revoked offline, which is a problem because they’re used by other parties for validating trust. Therefore, certificates have a built-in dead man’s switch that requires renewal. Passwords are not used for validating trust. They’re not comparable to certificates. Stop using certificates as an example of why passwords need to be rotated, because certificates don’t even use “rotation” in that sense of the word.
            • kuschku 9y ago
              > Passwords are a form of access control. I repeat: a strong password cannot be brute forced for billions of years. Even with technological advancements, most strong passwords are well over what’s required to literally be safe for a lifetime. The topic was never about brute forcing, that’s irrelevant. It’s always about exfiltrated passwords, certificates or session tokens. You usually have additional authentication requirements so that changing the password requires more than just the password, but an attacker that exfiltrates the password can still read everything. For example, an attacker that obtains my onlinebanking password will be able to read all transactions, but not make changes. In this way, the password acts identical to a session token – an attacker exfiltrating a session token will get the same access. The goal is to reduce this ability – changing the password as often as the offline session token ensures that if an attacker had such read access, as is possible with many services, this access will not continue forever. With your suggestion, of using an identical password for decades, a potential attacker has for decades read access to the bank account. This is undesirable. Yes, preventing exfiltration would be better, but exfiltrating session tokens and passwords is identical in terms of attack surface, and as result, they should be protected identically.
• dsacco 9y ago
  > Suppose it will take 100 years to crack your strong unique password once the file is breached. If the rotation period is 90 days, rotation gains you something. A strong password takes billions of years to crack with current computing power, assuming an entire datacenter is coordinating offline cracking on your password in particular.