Re:Password Requirements: Myths and Madness
by Someone1234 on Friday December 23, 2022 @09:20AM
(#34106057)
> Your assumption is that there's zero time between a leak and the abuse. If my password reaches the abuser after it expires, then I have been saved by the rotation.
Nope, that wasn't my assumption. What I said above applies there equally.
> Also rotation + "no reuse" policy essentially guarantees that eventually the password will be unique and not reused across services.
No it doesn't, in fact it increases password reuse and results in pattern-style passwords.
Also rotation + "no reuse" policy essentially guarantees that eventually the password will be unique and not reused across services.
Side note: I despise rotation as much as the next guy, but I can see the value in it. If users used password managers, generated passwords and not reused passwords, then we wouldn't need such rules. But alas 1234567890 is a common password.