> where it's safe to think that whoever is in charge of managing it has a security background.

Or even if they don't have a security background, that they'd at least be more secure than the average user. I guess a certificate is also something that you don't need to write down and remember, which could help.

Would a good takeaway be that expiring passwords would be helpful, if users weren't terrible about password management?

>Would a good takeaway be that expiring passwords would be helpful, if users weren't terrible about password management?

I think that's a fair assessment. Passwords are doubly risky in that they're regularly touched by human hands, and often transmitted directly over the network.

I think about security more often than many people I work with, but I recognize that I'm not immune to phishing myself. Rotating passwords sounds like a great idea, but in practice it results in people just choosing terrible passwords. Better to encourage systems that reduce the possibility for human error in the first place IMO (think WebAuthn and friends).

> I guess a certificate is also something that you don't need to write down and remember, which could help.

That's the main difference IMHO.

Certs that need some manual procedure to renew already share one of the problems of changing passwords: it's yet another notification that something needs to be done soon(tm), and sometimes it will not happen until it's too late.

First, users aren't terrible about password management. Passwords are a terrible system. If most people can't use the system correctly, it means that the system is a failure.

That failed system just happens to be the one we have been stuck with, because the solutions are to give users hardware (to prove possession) and/or build hardware into devices (to verify biometrics).

Generally not. The biggest risk with passwords is not that an attacker will magically pull them from the ether, but that they are revealed as part of a security breach.

The best password is not one thats overly complex or that you require the user to change on a set schedule. It's one that is unique.

Of course, once you have a second factor, you can resort back to much simpler, shared passwords and still retain security.

>Would a good takeaway be that expiring passwords would be helpful, if users weren't terrible about password management?

Absolutely, which is why it was considered a good practice in the past. A case of not taking into account the human factor /usability aspect.

It was a "good enough" practice until better options came along. It's never been a "good" practice. Take a look at lists of breached passwords and you'll see an overwhelming number of passwords that involve replacing vowels with numbers in common words. Humans are bad at picking complex passwords because they're not easy to remember. We had to adjust the rules over time to deal with that: minimum complexity rules, require a capital letter, require a number, require a "special" (but not too special because we still don't do proper sanitization), no repeating the same password until you've rotated N times, no repeating the same password until you've rotated N times AND there's a minimum age. Those rules all camebinto play because people can't be relied on to be smart about passwords.

Password expirations are insufficient and it has always been a game of cat-and-mouse with people who hate them. Good security is something people willingly use or don't know they're using, so they don't try and work around it.