6 ms·

>new password every 6 months This has been tried. It doesn't work. Two factor is the real solution.

• peterwwillis 8y ago
  Two factor only prevents someone logging into your current account; it doesn't prevent someone from reusing your password on a different system. I'm talking about two completely different attacks. One is password reuse, one is not. 2FA does not protect against password reuse, because not every system in the world offers 2FA.
  • ggggtez 8y ago
    2FA "only" prevents someone from logging into my account? What do you mean "only"? That's the whole point!
    • occamrazor 8y ago
      If you use the same password with a service with 2FA and one without, and the service with 2FA gets hacked, the attacker can access the service without 2FA with the stolen password. 2FA is a protection against password reuse only for the sites who use it.
• tomjen3 8y ago
  To be fair, most of the issues resulting from forcing password recycling were that people made password systems, incrementing numbers, using the months of the year, etc. I don't know of any, and I suspect there may not have been any, widely used consumer facing systems running around those lines. I suspect most of the problems can be mitigated in a scenario where the use gets a new password, rather than getting to create a new password. But yeah u2f 2fa is an absolute basic limit for serious services these days (pretty much anything else is subject to phishing).