3 ms·

Rotating passwords every so often is good advice, and I find it unlikely to discover a good reason not to. With a password manager, this process is pretty pain

Rotating passwords every so often is good advice, and I find it unlikely to discover a good reason not to. With a password manager, this process is pretty painless, if not automatic. Mandating it for my Hello Kitty: Island Adventure account seems a bit heavy-handed though. Rather than pulling back the recommendations, we should really be implementing open standards for automatic rotations that don't rely on reverse engineering / implementing various third party reset password flows.

kelnos 6y ago
> Rotating passwords every so often is good advice Why, though? The article debunks, with evidence, the usual reasons people give for requiring rotations. If something we doesn't measurably increase security, we should scrap it.
- nixpulvis 6y ago
  Debunks?! More like claims that I will most likely reuse or slightly modify the old password. > The same researchers have warned that mandating password changes every 30, 60, or 90 days—or any other period—can be harmful for a host of reasons. Chief among them, the requirements encourage end users to choose weaker passwords than they otherwise would. That is incorrect in my case since I generate random passwords, and no other evidence is cited. I would be curious what other reasons they have in mind. I agree in general, most people may not have password managers still, but that seems like the problem to be fixing, rather than relaxing security advice. Specifically, password managers for login passwords is a bit of a tricky subject, but that's why I hate the idea of "live" accounts, where my login password and online password are the same.
nixpulvis 6y ago
I should add that a password which you actually need to remember, like the master password to a password manager, should never be used online. The more isolation you can maintain the better. This way offline attacks against stolen hashes are unlikely to find anything, since they will only contain randomly generated passwords.

kelnos 6y ago

> Rotating passwords every so often is good advice Why, though? The article debunks, with evidence, the usual reasons people give for requiring rotations. If something we doesn't measurably increase security, we should scrap it.

nixpulvis 6y ago
Debunks?! More like claims that I will most likely reuse or slightly modify the old password. > The same researchers have warned that mandating password changes every 30, 60, or 90 days—or any other period—can be harmful for a host of reasons. Chief among them, the requirements encourage end users to choose weaker passwords than they otherwise would. That is incorrect in my case since I generate random passwords, and no other evidence is cited. I would be curious what other reasons they have in mind. I agree in general, most people may not have password managers still, but that seems like the problem to be fixing, rather than relaxing security advice. Specifically, password managers for login passwords is a bit of a tricky subject, but that's why I hate the idea of "live" accounts, where my login password and online password are the same.

nixpulvis 6y ago

I should add that a password which you actually need to remember, like the master password to a password manager, should never be used online. The more isolation you can maintain the better. This way offline attacks against stolen hashes are unlikely to find anything, since they will only contain randomly generated passwords.