[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <57189314.4070507@gmail.com>
Date: Thu, 21 Apr 2016 10:45:08 +0200
From: Martin Rublik <martin.rublik@...il.com>
To: passwords@...ts.openwall.com
Subject: Re: Mandatory password changes - DIEDIEDIE!
First of all let me state that I agree that in most systems mandatory password
changes are counterproductive, and creates problems than it solves. A few more
comments below.
On 20.04.2016 23:40, Per Thorsheim wrote:
>> 1. WE CAN AND SHOULD REQUIRE users to have LONG passwords,
>
> Disagree. Risk analysis should be applied. Having a long password won't
> help shit if all data is stored in plain on physically available disk.
> (No matter what rule you make, there will always be exceptions.)
Do you mean risk analysis by users or system architects? Users are generally not
very good at percieving risks, nor they do not need to know or understand all
the necessary details of the system. Also, should not be the
requirement/decision to change the password periodically also part of a risk
analysis?
One situation where mandatory password changes might actually improve security
are legacy systems, systems that were built/architected poorly. Systems where
for example only short passwords can be used. Not that the mandatory password
change is going to save them, but it might slow down the attacker a little.
Martin
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
