4 ms·
> They don't get weaker over time. Passwords do get weaker all the time, to the extent that they are used in multiple places. Changing the password on differen
by mjb 16y ago
> They don't get weaker over time.
Passwords do get weaker all the time, to the extent that they are used in multiple places. Changing the password on different systems on different schedules discourages password reuse. It also means the 'active' password is much less likely to be the password the employee used on a random news site they logged into once to comment.
There is obviously a balance to be had, because frequent rotations may encourage people to choose weaker passwords, but there is certainly value in expiring passwords.
- gaius 16y agoChanging the password on different systems on different schedules discourages password reuse. But it doesn't, it really doesn't. It just results in people buttonholing sysadmins in the corridor asking "when are you going to stop dicking around and implement SSO?". Not long after that, people just start ignoring security advice altogether.
- mjb 16y agoYou are right about reuse across multiple internal systems not being strongly discouraged. Where it does discourage reuse is across multiple systems, and with websites. Making me change my corporate password every 90 days is an effective way to ensure that I don't use my current password across a large number of websites. Maybe I'd go to the effort of making my gmail password the same as my corporate password. The password on that random news site account I forgot about? No ways. It's not a panacea, but password expiry does effectively limit the spread of passwords in many cases.