4 ms·

Rotating passwords is an old idea but mathematically it does reduce the probability of bring compromised. Otherwise I can know for certain when something is not

Rotating passwords is an old idea but mathematically it does reduce the probability of bring compromised. Otherwise I can know for certain when something is not your password each time I get it wrong.

Someone1234 4y ago
> Rotating passwords is an old idea but mathematically it does reduce the probability of bring compromised. Please can you show your work. Most websites limit the attempts per user per time, which should make direct request break-ins unrealistic to mathematically impossible. So now we move the needle to "Your user database has been stolen, someone is trying to break hashed + salted passwords" which is such a problematic scenario for so many other reasons (e.g. unencrypted password recovery information stolen, PII stolen, and social engineering information verification info stolen) that rotating user's passwords weeks-months later is such wishful thinking. Like, I legitimately don't get it. It was created in the late 1980s by people who just did what sounded right, and we've been stuck with it for over thirty years because change it hard.
- pontilanda 4y ago
  Your assumption is that there's zero time between a leak and the abuse. If my password reaches the abuser after it expires, then I have been saved by the rotation. Also rotation + "no reuse" policy essentially guarantees that eventually the password will be unique and not reused across services. Side note: I despise rotation as much as the next guy, but I can see the value in it. If users used password managers, generated passwords and not reused passwords, then we wouldn't need such rules. But alas 1234567890 is a common password.
  - Someone1234 4y ago
    > Your assumption is that there's zero time between a leak and the abuse. If my password reaches the abuser after it expires, then I have been saved by the rotation. Nope, that wasn't my assumption. What I said above applies there equally. > Also rotation + "no reuse" policy essentially guarantees that eventually the password will be unique and not reused across services. No it doesn't, in fact it increases password reuse and results in pattern-style passwords.
Aeolun 4y ago
That’s only true if people keep making similarly strong passwords every time. The first password may be secure, but I can practically guarantee that the security will have degraded significantly by the 4th time you change your password that year.
pontilanda 4y ago
I hate that HN users downvote concepts they disagree with. One can agree that rotation is good in theory and bad/annoying in practice (due to laziness). We can only argue about how much of an impact it makes, but it certainly does not reduce the security. We all deal with "password rotation" in real life and it's inescapable: credit cards expire. And to be fair I'm perfectly fine with that because I know a leak from 10 years ago can no longer affect me. I almost wish they expired earlier.
- josephcsible 4y ago
  > it certainly does not reduce the security. Yes it does. The more often you have to pick passwords, the more likely you are to pick weaker ones. > We all deal with "password rotation" in real life and it's inescapable: credit cards expire. And to be fair I'm perfectly fine with that because I know a leak from 10 years ago can no longer affect me. I almost wish they expired earlier. When a credit card is about to expire, doesn't the new one the bank sends you usually have the same number?
  - pontilanda 4y ago
    > doesn't the new one the bank sends you usually have the same number? Never happened to me using several European banks. Either way the date and CVV change so that's part of the new password. > Yes it does. The more often you have to pick passwords, the more likely you are to pick weaker ones. I don’t think so. People will just change the number at the end, it's not like they will stop using aDgTGdE and start using 11111112 simply because of rotation. It's more likely that they will append a ! or change helloworld to helloworld2. It's not a downgrade by any mean. Plus such rotation even "guarantees" that the password isn't shared across services, unless they're all rotating with the same frequency and they all start with helloworld2
    - Jon_Lowtek 4y ago
      > It's not a downgrade by any mean. If the minimum password length is 8 and the last two characters are the current month or year, the actual password length is roughly 6.

Someone1234 4y ago

> Rotating passwords is an old idea but mathematically it does reduce the probability of bring compromised. Please can you show your work. Most websites limit the attempts per user per time, which should make direct request break-ins unrealistic to mathematically impossible. So now we move the needle to "Your user database has been stolen, someone is trying to break hashed + salted passwords" which is such a problematic scenario for so many other reasons (e.g. unencrypted password recovery information stolen, PII stolen, and social engineering information verification info stolen) that rotating user's passwords weeks-months later is such wishful thinking. Like, I legitimately don't get it. It was created in the late 1980s by people who just did what sounded right, and we've been stuck with it for over thirty years because change it hard.

pontilanda 4y ago
Your assumption is that there's zero time between a leak and the abuse. If my password reaches the abuser after it expires, then I have been saved by the rotation. Also rotation + "no reuse" policy essentially guarantees that eventually the password will be unique and not reused across services. Side note: I despise rotation as much as the next guy, but I can see the value in it. If users used password managers, generated passwords and not reused passwords, then we wouldn't need such rules. But alas 1234567890 is a common password.
- Someone1234 4y ago
  > Your assumption is that there's zero time between a leak and the abuse. If my password reaches the abuser after it expires, then I have been saved by the rotation. Nope, that wasn't my assumption. What I said above applies there equally. > Also rotation + "no reuse" policy essentially guarantees that eventually the password will be unique and not reused across services. No it doesn't, in fact it increases password reuse and results in pattern-style passwords.

Aeolun 4y ago

That’s only true if people keep making similarly strong passwords every time. The first password may be secure, but I can practically guarantee that the security will have degraded significantly by the 4th time you change your password that year.

pontilanda 4y ago

I hate that HN users downvote concepts they disagree with. One can agree that rotation is good in theory and bad/annoying in practice (due to laziness). We can only argue about how much of an impact it makes, but it certainly does not reduce the security. We all deal with "password rotation" in real life and it's inescapable: credit cards expire. And to be fair I'm perfectly fine with that because I know a leak from 10 years ago can no longer affect me. I almost wish they expired earlier.

josephcsible 4y ago
> it certainly does not reduce the security. Yes it does. The more often you have to pick passwords, the more likely you are to pick weaker ones. > We all deal with "password rotation" in real life and it's inescapable: credit cards expire. And to be fair I'm perfectly fine with that because I know a leak from 10 years ago can no longer affect me. I almost wish they expired earlier. When a credit card is about to expire, doesn't the new one the bank sends you usually have the same number?
- pontilanda 4y ago
  > doesn't the new one the bank sends you usually have the same number? Never happened to me using several European banks. Either way the date and CVV change so that's part of the new password. > Yes it does. The more often you have to pick passwords, the more likely you are to pick weaker ones. I don’t think so. People will just change the number at the end, it's not like they will stop using aDgTGdE and start using 11111112 simply because of rotation. It's more likely that they will append a ! or change helloworld to helloworld2. It's not a downgrade by any mean. Plus such rotation even "guarantees" that the password isn't shared across services, unless they're all rotating with the same frequency and they all start with helloworld2
  - Jon_Lowtek 4y ago
    > It's not a downgrade by any mean. If the minimum password length is 8 and the last two characters are the current month or year, the actual password length is roughly 6.