3 ms·
> it's often the only way to ensure that the end user actually updates their password regularly It is fair to point out that the relevance of this is dependent
by afiori 7y ago
> it's often the only way to ensure that the end user actually updates their password regularly
It is fair to point out that the relevance of this is dependent on your attack model. If you suspect someone is trying to crack your password then just a longer password is fine. If you suspect a leak then you actually need to change/update password.
- Raistael 7y agoThis is largely true, but we also exist in a day and age where computing clusters can fire off billions of guesses per second. Anything less than 16 digits takes a questionably small amount of time in comparison, when paired with some of the more advanced attack vectors.
- hackinthebochs 7y ago2FA is the solution. That way the password is only to protect against someone who physically has access to your keyfob (nosey coworker, thief, etc). Thinking of passwords as the solution to protect against sophisticated actors is the mistake.
- Raistael 7y agoProperly implemented 2FA, for sure. Having been on both sides of various types of 2FA failures, but I definitely agree.
- afiori 7y agoThis is the wrong argument here. With regards to brute force attacks changing password is only relevant if the attack time is comparable to the password turnover. If it takes one week to crack a simple password but you only change it every six month then you have ~1/24 chance to actually increase the attack time.