3 ms·
I welcome websites removing mandatory password rotation. And it's true that rotating passwords doesn't necessarily reduce the chances of having it brute-forced.
by abunuwas 5y ago
I welcome websites removing mandatory password rotation. And it's true that rotating passwords doesn't necessarily reduce the chances of having it brute-forced. But that's not the point of changing passwords every so often. Rotating passwords is useful because a security vulnerability in the site or some mistake on your part can get the password exposed. You're not trying to protect yourself against super hackers (that's the website's responsibility), but against your own mistakes.
- dheera 5y agoYep. Every time a website asks me to rotate a password I end up using a bad password for a while and rotating it later.
- aequitas 5y agoI can't honestly think of any website that enforces password rotation. Except for corporate application websites, which I would consider application's that fall under my companies password security regime. I wouldn't want to image a world where every website would force me to rotate my password, each with it's own interval and method. Imagine the upkeep time cost.
- bombcar 5y agoMany of my banks do password rotation forces - one which annoyingly requires you to update your password if you haven't logged in in 90 days - but doesn't count Touch ID on their app as a login.
- kstrauser 5y agoAlmost every .gov I work with requires it regularly, along with account deactivation if you haven't logged in very recently. There's one particular website I have to log into exactly once per year. I have monthly reminders to log into and change my password anyway, lest I have to create a new account 10 months later.