3 ms·
In the current method, possible access risk is staggered, such that you only have access to some accounts, for some days. In your method, you have access to al
by setr 7y ago
In the current method, possible access risk is staggered, such that you only have access to some accounts, for some days.
In your method, you have access to all or none, for some days.
Staggered seems preferable.
Note that I’m only arguing your reasoning, not the broader point of password expiration
- Retric 7y agoOn day zero staggered means they still have access to ~100% of accounts. Hackers with access to 100 million accounts generally can use any of them, but not all of them. So, in practice access to 1% or 100% of all accounts may be equally damaging.