Ask HN: How often do you change your master password? | Hacker News Reader

Ask HN: How often do you change your master password?

5 pointsjordanpg2 comments

For users of password managers, how often (if ever) do you change your master password?

It's not easy to find concrete recommendations on this subject from the password manager authors. Here's 1password saying never change it[1]:

> But it’s not a good idea to regularly change your Master Password. Ideally, you should pick a good Master Password at the outset and never change it.

Can that really be true? Does it make sense to assume it never gets compromised?

I realize it depends on what networks you're using and how the PM works, but all systems are subject to compromise and mistakes.

How often do users of PMs change their master passwords? For which PMs? Why?

[1] https://blog.1password.com/toward-better-master-passwords/

I change mine every month, typically the last or first day.

Is this because of habit or is there a particular attack scenario that you're trying to mitigate?

If you're using a local password manager app such as KeePassXC, the password is almost a moot point as an attacker would need access to the password vault file. If they have this level of access to your system already, they could easily keylog your password or just dump the unlocked vault from memory. Changing the password also wouldn't really help as a previous version of the vault file could still be unlocked with the old password.

If you're using a cloud-based password manager such as 1Password, you're better sticking with a long, secure master password, rather than trying to remember a new one each month. As long as the password is unique and your local system is trusted, other security controls such as 2FA and account lockout should mitigate any concerns.

There are a few edge-case scenarios where changing your master password monthly may help:

* You reuse the password on other services (which you probably aren't as that's exactly what the password manager is for)

* You log on to your password manager using shared/untrusted devices

* Your local system was compromised sometime during the month, but then somehow isn't any more

Reply on news.ycombinator.com