3 ms·
>Why is it "good" to change your password periodically? I don't get it - why does no one mention the most obvious reason ? Is this a trap set up by math nazis
by b0rsuk 16y ago
>Why is it "good" to change your password periodically?
I don't get it - why does no one mention the most obvious reason ? Is this a trap set up by math nazis ? I have this feeling I may be the stupidest person in the room.
For the sake of argument, let's say all passwords on a server are numbers from 0 to 99. An attacker using a brute-force attack can try 5 passwords per day. So it will take at most 20 days to crack it. First day the chance is 5/100 = 1/20, second day is 5/95 = 1/19, third day is 5/90 = 1/18 and so forth#. So, as the time passes, it is more and more likely that the password will be cracked, because some combinations have already been tried. It's not 5/100 forever ! Now if you're forced to reset your password, the chance of guessing the password is restored to 5/100.
We can ponder the wisdom of forcing password changes if they take, say, 50 years to break with brute force. When the change is forced each year, chance is restored from 1/49 per year to 1/50 per year. Big deal ?
# There's a fairly simple formula for calculating the chance of k successes over n trials, given p probability of success in each trial .
http://en.wikipedia.org/wiki/Bernoulli_trial http://en.wikipedia.org/wiki/Bernoulli_trial
- Groxx 16y agoI think you missed iuguy's last paragraph. A rebuttal is in order, because I've seen this argument before: First: assuming a long, slow, undetected brute force is running, you have just as many chances at the beginning of helping the attacker by moving closer to their starting point as you do increasing the distance. It's the same whether you change it or not. Second: a long, un-detected brute force? Bull. Third: decent passwords negate brute forces entirely. Trillions-of-years entirely. We've established that changing passwords when you have a horribly insecure system might minimally improve things, but we have not established that changing secure passwords in any way helps.
- iuguy 16y ago> Second: a long, un-detected brute force? Bull. About 6 years ago this happened to us. A slow but persistent SSH brute force was targeting one of our servers. After we spotted it (it was an SSH brute force and because it was slow we didn't detect it over the noise of general SSH scans on port 22) we switched to public key auth only on the server and installed fail2ban.
- anthonyb 16y agoI wouldn't really count that as a brute force attack. That just comes with having an SSH server on the internet.