4 ms·

If password rotation is a bad idea, how do you deal with password compromises and credential stuffing attacks? Passwords tend to leak eventually.

• david-gpu 2y ago
  Reset the passwords that have been compromised rather than resetting them for no reason other than how long it's been since they were set up.
  • fire_lake 2y ago
    But then you are engaging in a race against the attacker that you will probably lose. Attackers use leaked creds before sharing them publicly.
    • david-gpu 2y ago
      You always are engaging in that race, whether you force users to change their passwords periodically or not.
• AStonesThrow 2y ago
  Simple--you work towards making password compromises less fruitful. MFA is a step in this direction, and done right, it should be able to alert admins and users alike that compromise and stuffing is in- progress. Password managers and generators can make unique passwords easy as pie, thereby reducing the rampant reuse, and unwillingness to reset passwords when necessary. Magic links and passkeys can make passwords obsolete. CAPTCHAs interfere with automated stuffing operations. The largest services are also developing sophisticated measures of device fingerprinting and trust, of which attestation is the endgame. Y'all don't enjoy credential stuffing or data breaches, but love rooting and rail against attestation, so do you want to have your cake and eat it too?