3 ms·

Worth keeping in mind that passwords do actually leak. Companies have had incidents where they were inadvertently logging secrets passed to them. I've also type

• dylan604 5y ago
  If you do not reuse passwords and one of them does leak, then the only thing affected is the site/service that was compromised. Hence the word "unique" in the title.
  • cromd 5y ago
    That is true, but that one secret is still at risk, and maybe that secret means the world to you. You don't know when the info will be discovered or change hands. "No need to change" could maybe be nitpicked even though I agree with it in general - changing seems to provide some marginal probabilistic benefit if done properly, and the cost/benefit probably depends on what you are protecting.
  • hyperman1 5y ago
    Scenario: Your device has a keylogger. It already happened that e.g. android device makers were overly aggressive in debug logging almost everything, including everything you type or paste on the clipboard. Leaking a password on your side is an unknown unknown, so password rotation is not a bad practice on its own for a security conscious person: It limits a leak in time. Mandatory password rotation is a whole different kettle of fish, as it pushes users to lower password quality. Infosec policy was required to balance 2 conflicting needs, and the past has thougt us we balanced wrong.
    • coder543 5y ago
      I think it's also worth pointing out that there are many reasons why 2FA is valuable. Even if someone ends up with your password, they would still need your second factor, which could be a TOTP token or a WebAuthn device like a YubiKey. Even if you rotated your password frequently, there would still be a large window of compromise. Password rotation only helps with very strange attack scenarios, and passwords themselves aren't really good enough for anything where security actually matters. I would personally push away from passwords on the whole at this point. SSO is probably more secure for most users. Plenty of websites only support username+password auth, and given how bad most passwords are... I might even go so far as to suggest that username+TOTP is instantly more secure than that, especially with proper rate limiting as you should have anyways. (Yes, I know TOTP is "supposed" to only be a second factor.) WebAuthn takes this to the next level and promises a future where you can use a strong single factor to log in, without any opportunity for phishing or credential compromise... but most implementations I've seen still require a fallback password mechanism. There are understandable reasons for this right now, but it is unfortunate.
    • tatersolid 5y ago
      If your old password was compromised by a keylogger, your newly rotated password will be too. There original threat model for forced password rotation was supposedly based on hash cracking time. This is a stupid threat model; the guy from NIST who wrote it back in the 80s admitted it was based on no research but was added arbitrarily because it sounded good at the time.
• londons_explore 5y ago
  > Is it too late if you change your password 6 months after it's compromised? I'd say no... some compromises are "2 step"... Ie. someone accidentally was logging the passwords in plaintext for a few months to some logs system (compromise 1)... and then years later some attacker breaks into the logs system (compromise 2). Or you accidentally typed a password into a terminal and it got stored in your .bash_history... and then months later you accidentally make your dotfiles github repo public, including your .bash_history containing your password... Also, some thieves may compromise your account but not do much evil with it (and remain undetected). And then many months later they sell your account to someone else who does do evil with it.