[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CALnMstXBxAJS-QniYQxYDZjuY5AhCU6POyBOe=6GRhFYzX-eAg@mail.gmail.com>
Date: Thu, 21 Apr 2016 11:52:57 +0300
From: Anton Dedov <adedov@...il.com>
To: passwords@...ts.openwall.com
Subject: Re: Mandatory password changes - DIEDIEDIE!
Hi!
I believe risk analysis for a service was meant:
1) Value of account the service provides
2) Does it implement enough compensations aside of password complexity
enforcement
As I understand it - requiring users to have long/super-strong passwords
for a sites like Pinterest or Pocket might be overkill. So leaving user
chance to choose any password according to perceived value of account but
implement all other compensating security means, like online guessing
protection and proper storage might be good choice for a service
implementation. But the same might not be true for services like email,
blogs, etc. And there are services that must have 2FA for critical
operations...
On Thu, Apr 21, 2016 at 11:45 AM, Martin Rublik <martin.rublik@...il.com>
wrote:
> First of all let me state that I agree that in most systems mandatory
> password
> changes are counterproductive, and creates problems than it solves. A few
> more
> comments below.
>
> On 20.04.2016 23:40, Per Thorsheim wrote:
> >> 1. WE CAN AND SHOULD REQUIRE users to have LONG passwords,
> >
> > Disagree. Risk analysis should be applied. Having a long password won't
> > help shit if all data is stored in plain on physically available disk.
> > (No matter what rule you make, there will always be exceptions.)
>
> Do you mean risk analysis by users or system architects? Users are
> generally not
> very good at percieving risks, nor they do not need to know or understand
> all
> the necessary details of the system. Also, should not be the
> requirement/decision to change the password periodically also part of a
> risk
> analysis?
>
> One situation where mandatory password changes might actually improve
> security
> are legacy systems, systems that were built/architected poorly. Systems
> where
> for example only short passwords can be used. Not that the mandatory
> password
> change is going to save them, but it might slow down the attacker a little.
>
>
> Martin
>
--
Anton Dedov
Content of type "text/html" skipped
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
