Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm asking two very related questions

  1. As an admin what policies should be enforced regarding the frequency of password changing? I have an idea that users should be forced to change their password after a certain amount of time but a certain amount of login attempts. For example if 30 incorrect passwords were entered the next time the user logs in they must change their password.
  2. For situations where I'm not the admin and there is no password expiry how often should I changed the password? For example my cellphone provider doesn't require me to change the password and I haven't for over a year, though the password is quite complex.
share|improve this question
    
I had assumed that the logic behind enforced password changes was to reduce risk against a password being used across multiple sites, and being compromised elsewhere. At one extreme, forcing daily password changes would make it essentially impossible for a user to be using the same password elsewhere. –  Steve Bennett Jan 31 at 0:03
    

2 Answers 2

up vote 5 down vote accepted

The brute force attack can be described as such: the attacker tries a lot of random potential passwords, until the right one is found. Forcing a password change for the user, i.e. changing from one potential password to another, does not substantially lower the success rate of the attacker (indeed, it changes anything only if the spaceof possible passwords is so small that the attacker can explore it exaustively -- and this means that you have a bigger problem, which is that your users choose very weak passwords). It is a widespread, but wrong belief that password changes somehow "restore security".

What may make sense is to disable accounts which are the target of a brute force attack, indicated by a lot of failed attempts. But this kind of locking feature can backfire: it allows anybody to lock the account of anybody else, which can turn into a big helpdesk problem.

Correspondingly, there is no need for you to change your cellphone provider password because it is old. Change your password if it is weak, but weakness does not grow over time; it is there right from day 1.

share|improve this answer

I have to disagree with Tom on "there is no need to change your password because it is old...".

In and of itself, that is reasonably true, however the pragmatics of real life interfere with theory and make that not so true. Since we are oftentimes asked to enter our passwords in many different environments and places - some of which we do not always control, it is my opinion that having good password changing schedules is a policy that should be in place and is a peer policy to strength.

There is too much of a possibility for 1 time a password is entered in a compromised environment and it is captured, or (as I often see it), an admin is given (for a momentary purpose, but they keep it around) a password to accomplish a task while someone is travelling... or some other reason like that. Without password change schedules in effect, you have no way of re-baselining the risk associated with these spurious and random events.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.