Hacker News Reader

Not trying to set myself to be a target of hacking with this comment, but what's wrong with that? Why does a password that wasn't hacked need to be changed a lot? If someone is going to try to break into my account my password being similar to one I used 6 months ago increases my vulnerability how?

View on HN

The point of changing your password is to prevent a password leak from affecting your system. If an unauthorized user has a password they have access until it's changed.

If the change isn't meaningful they can continue using credentials.

It vastly reduces the key space for a brute force attack, e.g. if an attacker has access to old passwords, they can brute force ~50% of them by iterating through A-z0-9 fairly quickly.

Reply on news.ycombinator.com