Hacker News Reader

Parent Full thread

nixpulvis

Automated password rotation would use machine generated highly secure passwords. I do not see your point.

This issue for master passwords is a bit harder, yes.

View on HN

> Automated password rotation would use machine generated highly secure passwords.

Which will result in two things:

1. LOTS of calls to IT from forgotten passwords

2. People writing their passwords down on sticky notes.

I don't really see the issue with people writing their passwords down on sticky notes.

If you're using machine-generated passwords, then what's the point of rotating them?

Breaches happen. You can't always be sure you (or dictionaries) will know.

Even assuming a silent breach happens, it's unclear what's the value-add of password rotation in the context of other solutions that are less burdensome on the user: proper hashing of password databases (in case of a password DB breach) and risk-based authentication (in case of an inadvertent disclosure, like in logs).

Reply on news.ycombinator.com