Hacker News Reader

Comment by ocdtrekkie | Hacker News Reader

Yeah, I think there's value in it, but if you don't have a way to prevent "plus one passwords", it probably isn't super effective anyways. It may be a case where frustrating the user four times a year isn't worth it... maybe just frustrating them once a year will lead people to put more effort into making their passwords suitably different.

View on HN

Four times a year? I've had to change mine once a month for the past 20 years. Needless to say, I increment a numeric suffix that wraps around every 10 or so months.

It has always seemed like a totally pointless exercise.

I can see potential value for service accounts, as long as you have automation in place to change them where needed - but for user accounts, it's complete madness.

Hum... I have never seen any place that implemented password rotation for the users and didn't exempt service accounts. And the security solution sellers I've talked to are all either on the position of "yeah, password rotation is incredibly important, but you can't rotate service accounts" or "yeah, I know you don't rotate the password of service accounts (no need to tell me), here's a tool to reduce the risk this causes".

Microsoft's approach now is to recommend using Managed Service Accounts, which is an Active Directory feature in modern Windows servers. They rotate their own passwords through some sort of magic. That being said, plenty of janky old Windows apps won't work with them anyways.

Place I work started rotating service account passwords around a year ago, using automation built in to some super expensive PIM (Privileged Identity Management) system.

Just to complement, so next time I can say I heard about one place on the internet... Does your workplace require password rotation for personal users?

Yes it does - something like once a month. And every.single.employee is going to be incrementing a numeric suffix, providing no increase to security whatsoever, and annoying the hell out of every.single.employee. Actually, it probably weakens security, since employees will be more likely to have notes of their current password around, since it's difficult to remember the current suffix, since it changes so damn often :/

"A friend" used to have the password set to the 3 character month name + the month ordinal + "!" - MarMar04!

We were required to change passwords once a month, and not re-use any of our last 6 passwords.

My "friend" doesn't use this system anymore, but passwords along the line of '1stQuarter2001!' worked for well over a decade of being required to change passwords 4 times a year.

Am I the only one bothered by month ordinal 04 assigned to March, which is the 3rd month? This sounds almost like Java's infamous Date class that assigned month ordinal 2 for March, except somehow we've managed to make the off-by-one error in the other direction :D

Nice! My friend rotate through 3 digits to be able to guess it quicker when he forgets which digit it is. This solves it.

There definitely is value in it if users created proper passwords, but path of least resistance tends to win out in the end, and people will just find ways around the mechanisms to prevent weaker derived passwords.

Reply on news.ycombinator.com