4 ms·

Reset the passwords that have been compromised rather than resetting them for no reason other than how long it's been since they were set up.

• fire_lake 2y ago
  But then you are engaging in a race against the attacker that you will probably lose. Attackers use leaked creds before sharing them publicly.
  • david-gpu 2y ago
    You always are engaging in that race, whether you force users to change their passwords periodically or not.