3 ms·

> Rotating passwords is an old idea but mathematically it does reduce the probability of bring compromised. Please can you show your work. Most websites limit

> Rotating passwords is an old idea but mathematically it does reduce the probability of bring compromised. Please can you show your work. Most websites limit the attempts per user per time, which should make direct request break-ins unrealistic to mathematically impossible. So now we move the needle to "Your user database has been stolen, someone is trying to break hashed + salted passwords" which is such a problematic scenario for so many other reasons (e.g. unencrypted password recovery information stolen, PII stolen, and social engineering information verification info stolen) that rotating user's passwords weeks-months later is such wishful thinking. Like, I legitimately don't get it. It was created in the late 1980s by people who just did what sounded right, and we've been stuck with it for over thirty years because change it hard.

pontilanda 4y ago
Your assumption is that there's zero time between a leak and the abuse. If my password reaches the abuser after it expires, then I have been saved by the rotation. Also rotation + "no reuse" policy essentially guarantees that eventually the password will be unique and not reused across services. Side note: I despise rotation as much as the next guy, but I can see the value in it. If users used password managers, generated passwords and not reused passwords, then we wouldn't need such rules. But alas 1234567890 is a common password.
- Someone1234 4y ago
  > Your assumption is that there's zero time between a leak and the abuse. If my password reaches the abuser after it expires, then I have been saved by the rotation. Nope, that wasn't my assumption. What I said above applies there equally. > Also rotation + "no reuse" policy essentially guarantees that eventually the password will be unique and not reused across services. No it doesn't, in fact it increases password reuse and results in pattern-style passwords.

pontilanda 4y ago

Your assumption is that there's zero time between a leak and the abuse. If my password reaches the abuser after it expires, then I have been saved by the rotation. Also rotation + "no reuse" policy essentially guarantees that eventually the password will be unique and not reused across services. Side note: I despise rotation as much as the next guy, but I can see the value in it. If users used password managers, generated passwords and not reused passwords, then we wouldn't need such rules. But alas 1234567890 is a common password.

Someone1234 4y ago
> Your assumption is that there's zero time between a leak and the abuse. If my password reaches the abuser after it expires, then I have been saved by the rotation. Nope, that wasn't my assumption. What I said above applies there equally. > Also rotation + "no reuse" policy essentially guarantees that eventually the password will be unique and not reused across services. No it doesn't, in fact it increases password reuse and results in pattern-style passwords.