3 ms·

How did this idea of expiring passwords arise in the first place? Misguided intuition or did the infosec people back then just get it wrong?

extra88 7y ago
I don't know the origin story but (U.S.) National Institute of Standards and Technology (NIST) recommending password expirations from 2003 until 2016 played a part in propagating them. But I think that recommendation was largely based on was already fairly common, I think Microsoft Windows and Active Directory accounts expired by default well before 2003 (at least Windows NT and its successors).
dredmorbius 7y ago
It's existed in some form since at least the 1990s, likely through institutional or government practice. A (possible) example from a 1997 Sybase manual: https://books.google.com/books?id=GzGuPO5fKOEC&q="password+expiration"&dq="password+expiration"&hl=en&sa=X&ved=0ahUKEwjv7sHz_sviAhVCKa0KHUpPC7Y4ChDoAQgMMAA https://books.google.com/books?id=GzGuPO5fKOEC&q="password+e... I just checked Simpson & Garfinkel's PUIS, which does mention forced changes, but not scheduled expiry. Also 1997. (Google Book Search is badly polluted by mis-dated publications: http://www.google.com/search?q="password+expiration"&lr=lang_en&tbs=lr:lang_1en&tbm=bks&ei=FmH0XO-LGsLStAXKnq2wCw&start=20&sa=N http://www.google.com/search?q="password+expiration"&lr=lang... ) Ngram plot: https://books.google.com/ngrams/graph?content=password+expiration&year_start=1980&year_end=2000&corpus=15&smoothing=3&share=&direct_url=t1%3B%2Cpassword%20expiration%3B%2Cc0 https://books.google.com/ngrams/graph?content=password+expir...
- ScottBurson 7y ago
  The man's name is Simson Garfinkel — no "p" and no "&". (Your brain is probably confusing him with Simon & Garfunkel.)
  - dredmorbius 7y ago
    Spafford and Garfinkel was what I'd meant to write. Unreliable tablet input compounding even less reliable short-term working memory. http://shop.oreilly.com/product/9781565921481.do http://shop.oreilly.com/product/9781565921481.do

extra88 7y ago

I don't know the origin story but (U.S.) National Institute of Standards and Technology (NIST) recommending password expirations from 2003 until 2016 played a part in propagating them. But I think that recommendation was largely based on was already fairly common, I think Microsoft Windows and Active Directory accounts expired by default well before 2003 (at least Windows NT and its successors).

dredmorbius 7y ago

It's existed in some form since at least the 1990s, likely through institutional or government practice. A (possible) example from a 1997 Sybase manual: https://books.google.com/books?id=GzGuPO5fKOEC&q="password+expiration"&dq="password+expiration"&hl=en&sa=X&ved=0ahUKEwjv7sHz_sviAhVCKa0KHUpPC7Y4ChDoAQgMMAA https://books.google.com/books?id=GzGuPO5fKOEC&q="password+e... I just checked Simpson & Garfinkel's PUIS, which does mention forced changes, but not scheduled expiry. Also 1997. (Google Book Search is badly polluted by mis-dated publications: http://www.google.com/search?q="password+expiration"&lr=lang_en&tbs=lr:lang_1en&tbm=bks&ei=FmH0XO-LGsLStAXKnq2wCw&start=20&sa=N http://www.google.com/search?q="password+expiration"&lr=lang... ) Ngram plot: https://books.google.com/ngrams/graph?content=password+expiration&year_start=1980&year_end=2000&corpus=15&smoothing=3&share=&direct_url=t1%3B%2Cpassword%20expiration%3B%2Cc0 https://books.google.com/ngrams/graph?content=password+expir...

ScottBurson 7y ago
The man's name is Simson Garfinkel — no "p" and no "&". (Your brain is probably confusing him with Simon & Garfunkel.)
- dredmorbius 7y ago
  Spafford and Garfinkel was what I'd meant to write. Unreliable tablet input compounding even less reliable short-term working memory. http://shop.oreilly.com/product/9781565921481.do http://shop.oreilly.com/product/9781565921481.do