4 ms·
Please do not group password rotation and special character restriction. One strengthens, the other weakens security. The only reason I can think that rotation
by nixpulvis 5y ago
Please do not group password rotation and special character restriction. One strengthens, the other weakens security. The only reason I can think that rotation would be a bad idea (aside from frustration, which is another very critical issue) is if users are not using strong passwords on each iteration.
The solution is for a standard to emerge that incorporates rotation and (optionally random) password generation used across sites. No more fucking "Login with Google".
- mox1 5y ago10+ years of data has strongly indicated that yes indeed "rotation is a bad idea, because users don't use strong passwords when they are forced to rotate them"
- nixpulvis 5y agoPlease read my full comment.
- philovivero 5y agoAh yes. The age-old conversation. A: It's a good idea! B: In theory, yes. In practice, no. A: I'm only talking theory. Great. The rest of us are talking about practice.
- deleted 5y ago[deleted]
- coder543 5y agoPassword rotation does not strengthen security.
- nixpulvis 5y agoExplain?
- Zxian 5y agoThe intent of the policy doesn't match the real-world implementation of users. Users are lazy. Users will alter a single character or digit in the password and call it changed. Most people don't use password managers, and some companies block their usage. Now add a requirement of a "secure" password.
- nixpulvis 5y agoAutomated password rotation would use machine generated highly secure passwords. I do not see your point. This issue for master passwords is a bit harder, yes.
- the_snooze 5y agoIf you're using machine-generated passwords, then what's the point of rotating them?
- ryanisnan 5y agoBreaches happen. You can't always be sure you (or dictionaries) will know.
- the_snooze 5y agoEven assuming a silent breach happens, it's unclear what's the value-add of password rotation in the context of other solutions that are less burdensome on the user: proper hashing of password databases (in case of a password DB breach) and risk-based authentication (in case of an inadvertent disclosure, like in logs).
- Sohcahtoa82 5y ago> Automated password rotation would use machine generated highly secure passwords. Which will result in two things: 1. LOTS of calls to IT from forgotten passwords 2. People writing their passwords down on sticky notes.
- johncessna 5y agoAnother reason rotation is bad is because it put undo burden on the user. You're now combining the unneeded burden of password rotation with the unneeded burden of a randomly generated password for a user to remember. Of course, by remember, I mean put in a .txt file somewhere. Both of your suggests disregards the user's experience and security is only ever as good as your user's willingness to use it.
- Arnavion 5y agoIf we're going to talk about hypotheticals where the whole world is able to switch to machine-generated passwords, I'd rather it switch to machine-generated asymmetric keys and leave the problem of breaches in the past.