3 ms·
Your last paragraph actually has a very good point - why do companies insist on changing the employee passwords every month? Chances are, if somebody got hold o
by Sandman 16y ago
Your last paragraph actually has a very good point - why do companies insist on changing the employee passwords every month? Chances are, if somebody got hold of your password, he/she is not going to wait a month before using that knowledge, right? So, really, I'm curious as to why most companies have this policy.
- gaius 16y agoBecause, let's be honest, most "security consultants" are people who couldn't make it as sysadmins, and they've no idea what they're doing.
- count 16y agoPasswords historically got weaker over time, but not in the sense that 'if he got your password hes not going to wait to use it'. They weaken in their hashed form. It used to be (still is, really) trivial to score the passwd file of a system, and get all the hashes of passwords, but no plaintext. By changing passwords every N months, you eliminated the ability of someone to crack the hashes and obtain a cleartext password where they previously only had a hash. That time window has gotten absurdly short, however...and with Pass the Hash and MITM, I don't even need your password anymore :(