Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In many places, there's a policy that force the user changing it's password once a few months. The logic here is, that even if the password have leaked somehow, it'll be abused only for a relatively short period of time. So that a note with your password you threw to your bin now, will not come and hunt you in five years.

But what this policy is missing IMHO is, the people factor. What many people usually do when forced to change their password, is to choose a new password not to too far from the original one. Since it's hard to memorize the new password every month. For example

foo1bar
foo2bar
foo3bar

or so. So an attacker with a minimal amount of sense, would activate john-the-ripper or equivalent, and find out your password in no time. Heck, the entropy of the new password given the old password is typically so low, so that you can even bypass a password system that alerts the admin if you entered the wrong password three times in a row. You'll probably find the new one within 10 trials, and given that the user logs in once a day an attack will be able to find it out within a month.

So I'm asking, will a policy that force users to change their password once in a while actually provides more security than its cost?

share|improve this question
add comment

4 Answers

up vote 2 down vote accepted

Have a look at our extensive blog post on this topic and the original question which inspired it.

The answers and discussion complement and extend @Thomas' answer.

share|improve this answer
    
Thanks. This question is not the same as mine, but the blog post is very similar. After reading that I still hold the opinion that it's not really that useful. If you really care about lost passwords - go for two factors authentication. If you don't - you'd get more or less the same security with no password expiration. –  Elazar Leibovich Sep 15 '11 at 12:13
add comment

As you note, when you force users to do something, they do not like it, because it makes things more difficult for them. Users rarely focus on security; it is not their job, and, instead, their job implies going through the hoops that the security department comes up with. So they react logically, by taking measures which make their life easier.

Classical countermeasures employed by users include:

  • simple derivation of the new password from the previous one (but there are password management interfaces which try to prevent that: "the new password is too similar to the old password");

  • cycling through a list of passwords, usually reduced to two passwords; the user just swaps his "normal" and "alternate" passwords whenever a password change is requested (to prevent that, the password management system must remember previous passwords, which can itself be a security hazard);

  • the all-time favorite of writing the passwords down on a sticky note (cunningly hidden under the keyboard);

  • getting passwords from a "natural list", e.g. current players in a soccer team (it is not easy to make an automated test which will detect that, but a human attacker with half a neuron will handle that easily).

So the increase of security through regular password change will be, at best, dubious. Its main virtue is to avoid the establishment of a local "traditional password" which employees communicate to each other for years, and previous employees keep on remembering.

Theoretically, regular password change might give users a sense of "something worth protecting is going on" and prompt them into being more cautious with their passwords; in practice, I have never witnessed that.

share|improve this answer
1  
I'm not sure it's that easy to prevent effectively new password which is too similar to old password (password.reverse(), password[i].toupper() etc etc). –  Elazar Leibovich Sep 15 '11 at 12:08
add comment

One of the aspects which isn't mentioed yet, is in my opinion the most important one - awareness of the user. I can tell you from experience that whenever you can give users a demo of what the impact would be of a bad password and make them aware of it, they will start to value and understand it. Awareness is exactly the reason that we, security people, understand the problem. We know the impact, ordinary users don't.

Show it to them in a workshop by breaking in as they witness it, so they understand the root cause of the password policy.

share|improve this answer
add comment

In addition to some of the reasons above, changing passwords also helps keep hackers from cracking stolen encrypted credentials and using them. If the time between resets is smaller than the time it will conceivably take to crack the hash, the attacker cannot use the password.

For example, imagine if a bank loses their entire encrypted database of passwords, but doesn't realize it. The bank requires the use of passwords that are complex in nature, and at least 10 characters in length, and requires a reset every 90 days. The hackers have at their disposal a system which will crack an average 10 character complex hash within 120 days.

So, if the users are changing their passwords every 90 days, the stolen encrypted credentials will 'expire' before the hackers have the time to crack them.

Obviously, modern cracking systems can do a lot better than 120 days, but it's still a good example because of one thing: How many user accounts do the hackers want to have cracked before they go do something evil? One might net them $200 bucks, but 20,000 will net them $2 Million. Hiding in those numbers is a good risk management method as well, as getting 20,000 username/password combinations would easily take months.

*Note: All the times I give are guesswork. There are a lot of variables that go into cracking a password, and not all of them are predictable.

Mike

share|improve this answer
    
Huh? Why would they expire. After 120 days the hackers will find out the password for "Joe" is "foo1", they'll try "foo1", "foo2" and "foo3" and they'll get his password eventually. –  Elazar Leibovich Sep 15 '11 at 18:58
    
That's still a brute force attack though. How does the attacker know it's foo2? It could be foo1bas, or goo1bar, or any number of other small incremental changes to a password. Though maybe I'm too numb to individual users since I do security for 100s, and don't pay enough attention to spear-phish type attacks. –  MToecker Sep 15 '11 at 19:37
    
of course that it can be different, but the entropy of the new password given the old password is very low, and the bad guys can probably figure it out in 100 guesses in the worst case. That's my point exactly. The theoretical benefit of "brand new password every X days" is nonexistant, since the password is probably one character away from the old one. –  Elazar Leibovich Sep 16 '11 at 12:59
    
@MToecker In my experience, three out of the three users I've asked just increment a number each time they change their password. The number is the only number in the password, AND it's a single-digit that rolls over. Now, I admit my sample-size is small, but given that, it would be really easy to have a computer try all 10 passwords for you, or even do it by hand. –  Patrick M Mar 16 '13 at 16:16
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.