3 ms·
How do you know if the password has been breached? More than not, you don’t. Hence, change password rutinely. That’s the logic, I presume.
by redbar0n 5y ago
How do you know if the password has been breached? More than not, you don’t. Hence, change password rutinely. That’s the logic, I presume.
- bborud 5y agoYou don't; except in a very limited sense if you use tools that check your passwords regularly against password leaks. But that still doesn't mean forced regular password rotation makes you safer. Changing your password is in itself a relatively high risk activity. And the likelihood of your password leaking tends to be dependent on factors you control. For instance, if you assume that a given service provider won't leak their password database (which is usually hashed in some way), you are being optimistic. You should always expect that this can happen and act accordingly when choosing, or preferably generating, a new password.
- redbar0n 5y ago> And the likelihood of your password leaking tends to be dependent on factors you control. Do you mean if you reuse the same password(s)? > But that still doesn't mean forced regular password rotation makes you safer. Would you say that even for people who use a password mamager and generate their passwords?