Hacker News Reader

The justification I heard was in case your password was leaked/hacked (and nobody knew), it wouldn't be good forever.

I'm not supporting that position, just what I heard many years ago when talking with a security person.

I work in security and yes, it definitely helps in some cases with preventing lateral movement. Since servers aren't rebooted often, if I choose to run mimikatz to dump creds off of the server and steal a user's password, that password may as well be useless if the user logged in long enough for a password reset to have been enforced in that time.

Reply on news.ycombinator.com