Hacker News Reader

Comment by nixpulvis | Hacker News Reader

Please do not group password rotation and special character restriction. One strengthens, the other weakens security. The only reason I can think that rotation would be a bad idea (aside from frustration, which is another very critical issue) is if users are not using strong passwords on each iteration.

The solution is for a standard to emerge that incorporates rotation and (optionally random) password generation used across sites. No more fucking "Login with Google".

View on HN

10+ years of data has strongly indicated that yes indeed "rotation is a bad idea, because users don't use strong passwords when they are forced to rotate them"

Please read my full comment.

Ah yes. The age-old conversation.

A: It's a good idea! B: In theory, yes. In practice, no. A: I'm only talking theory.

Great. The rest of us are talking about practice.

Password rotation does not strengthen security.

Explain?

The intent of the policy doesn't match the real-world implementation of users. Users are lazy. Users will alter a single character or digit in the password and call it changed.

Most people don't use password managers, and some companies block their usage. Now add a requirement of a "secure" password.

Automated password rotation would use machine generated highly secure passwords. I do not see your point.

This issue for master passwords is a bit harder, yes.

If you're using machine-generated passwords, then what's the point of rotating them?

Breaches happen. You can't always be sure you (or dictionaries) will know.

Even assuming a silent breach happens, it's unclear what's the value-add of password rotation in the context of other solutions that are less burdensome on the user: proper hashing of password databases (in case of a password DB breach) and risk-based authentication (in case of an inadvertent disclosure, like in logs).

> Automated password rotation would use machine generated highly secure passwords.

Which will result in two things:

1. LOTS of calls to IT from forgotten passwords

2. People writing their passwords down on sticky notes.

I don't really see the issue with people writing their passwords down on sticky notes.

Another reason rotation is bad is because it put undo burden on the user. You're now combining the unneeded burden of password rotation with the unneeded burden of a randomly generated password for a user to remember.

Of course, by remember, I mean put in a .txt file somewhere.

Both of your suggests disregards the user's experience and security is only ever as good as your user's willingness to use it.

If we're going to talk about hypotheticals where the whole world is able to switch to machine-generated passwords, I'd rather it switch to machine-generated asymmetric keys and leave the problem of breaches in the past.

Reply on news.ycombinator.com