4 ms·
Ask HN: Do password reset policies really prevent security issues?
Per the title, I'm curious if the security-minded folks amongst us feel that forced password resets (particularly on Windows hosts) make a real difference. I understand it's not a philosophy that will change, as it's the stuff of baseline security, but am curious as to whether or not its value is perceived as high.
- smt88 12y agoThere was a widely-circulated study a few years ago that showed that those policies result in lower security. The advantage of a forced reset is this: if your password has been stolen but not yet used, then you're locking the thief out. The disadvantage is this: the greater password strength that is required and the more times someone has to come up with a new password, the more often they'll take shortcuts. Those shortcuts result in easier brute-force or heuristic attacks. So if you look at the advantage, it's very small and potentially non-existent. It's rare to steal a password from a high-value target and then sit on it, especially for as long as a few months. Looking at the disadvantage, it's actually very high, and it makes it easier to steal passwords in the first place.
- beams_of_light 12y agoI figured that might be the case. Would it help to have password reset policies in the time frames of years, I wonder? A stolen password might be used inconspicuously for some time. I'd prefer two-factor became more ubiquitous.