Date: Thu, 21 Apr 2016 10:45:08 +0200 From: Martin Rublik <martin.rublik@...il.com> To: passwords@...ts.openwall.com Subject: Re: Mandatory password changes - DIEDIEDIE! First of all let me state that I agree that in most systems mandatory password changes are counterproductive, and creates problems than it solves. A few more comments below. On 20.04.2016 23:40, Per Thorsheim wrote: >> 1. WE CAN AND SHOULD REQUIRE users to have LONG passwords, > > Disagree. Risk analysis should be applied. Having a long password won't > help shit if all data is stored in plain on physically available disk. > (No matter what rule you make, there will always be exceptions.) Do you mean risk analysis by users or system architects? Users are generally not very good at percieving risks, nor they do not need to know or understand all the necessary details of the system. Also, should not be the requirement/decision to change the password periodically also part of a risk analysis? One situation where mandatory password changes might actually improve security are legacy systems, systems that were built/architected poorly. Systems where for example only short passwords can be used. Not that the mandatory password change is going to save them, but it might slow down the attacker a little. Martin
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.