3 ms·
If you rotate passwords every month, your users will be annoyed and use password that are either trivial, will write it down passwords, or have a trivial variat
by cjensen 12y ago
If you rotate passwords every month, your users will be annoyed and use password that are either trivial, will write it down passwords, or have a trivial variation from month to month.
In other words, they will resort to using less-secure passwords. The notion that rotating passwords improves security is little more than a cargo-cult.
- x1798DE 12y agoKeeping a password written down (in your wallet, in your desk, etc) is probably safer than you'd think, because people generally know how to secure physical items, but they're much less certain about how to secure digital information. I think it's obvious that expiring passwords increases security to some degree. It's also clear that user reactions will induce people to reduce the security of those passwords. The password expiry interval you choose (potentially as long as the duration of the system's existence) depends on your threat model, really. Security is hard and often application-specific.