4 ms·
If a hacker found an old password of yours, the month an year would be a pretty easy indictor of what to try next, right?
by harryvederci 5y ago
If a hacker found an old password of yours, the month an year would be a pretty easy indictor of what to try next, right?
- rgoulter 5y agoIt's a trade-off of convenience vs security. If you're worried a password will leak, how frequently should you rotate it to maintain security? e.g. Even rotating yearly still seems a chore if you do it for websites you don't frequently visit (such as sites you made 1 order from). The "add YYMMDD" or whatever is a way of working around a policy which automatically enforces a more frequent rotation than you want.
- KMnO4 5y agoMy security policy is based on the most common data breaches, where an adversary obtains a big list of email/passwords and just tries them on a handful of sites (Facebook, Twitter, etc), throwing out the records that don't work. Sure, it's technically possible to decipher the algorithm[0] I use to generate new passwords, but that's not what I'm protecting against. If someone is trying to attack a specific person, there are much more effective ways[1]. [0]: For example, if my password for HN is "1y2c3o4m5b!$", you could sit down and figure out my reddit password. [1]: https://gizmodo.com/how-i-lost-my-50-000-twitter-username-1511578384 https://gizmodo.com/how-i-lost-my-50-000-twitter-username-15...
- simonbarker87 5y agoOh yeh it’s not ideal but the alternative is my relatives having a post-it note nearby with their current password written down - I feel this is a lesser of two evils