4 ms·

My password tool shows me which are oldest. So, quarterly (on tax day) I also make sure to change a few of them.

• avidiax 3y ago
  What's the theory? Nobody is spending a year to crack your passwords or use a leaked password, so either they are strong enough to resist online or offline attacks, or they aren't. If they aren't strong enough, then you would have to rotate much more often than every few years.
  • stcredzero 3y ago
    Nobody is spending a year to crack your passwords or use a leaked password How strong is that nowadays? How many bits of entropy?
  • notwhereyouare 3y ago
    they may not, but if there is a password dump, you password isn't super old and has been rotated fairly recently
  • djbusby 3y ago
    Theory is that I'll rotate out passwords insecure? systems. One case I know is that in one system my old password was hashed with an older method (which was the right choice at the time) and when I reset I'm now using their updated (right choice today) hash. Another feature is that services I don't use I'm reminded to close/deactivate.
  • rantallion 3y ago
    Assuming we start from the position of having a unique, never-before-seen password for each account (which is what we should all be doing, right?), rotating doesn't do anything. And if we accept that most people don't use unique, never-before-seen passwords and that a password has been included in a plaintext dump, rotating passwords periodically doesn't even protect from password spray attacks, since someone has likely used that password before and you'll still be vulnerable.