Possible Duplicate:
How does changing your password every 90 days increase security?

What are best practices for password expiration policies?

There are some questions that already address this issue:

But they seem to be very heavy on anecdotal evidence, and very light on definitive answers.

The general list of arguments for and against password expiration policies seems to boil down to (as listed in the relevant IT Security Blog post):

Expiration pros:

  • To mitigate the problems that would occur if an attacker acquired the password hashes of your system
  • It prevents people who use the same password for everything from getting your system compromised if their password is figured out somewhere else
  • Compliance reduces the risk of penalties of non-compliance (thanks @AviD)
  • By resetting password every X days we are telling the user – Hey, this is important and it should not be taken lightly

Expiration cons:

  • Your password, and the attacker’s guess at your password, are independent. The probability that the attacker’s next guess is correct is the same even if you change your password first.
  • Nothing encourages passwords on post-its quite like frequent expiration, especially if there are also high complexity requirements
  • It annoys users
  • They end up having to work out a new password – which research shows is often is derived from the previous one in a way that is very easy to crack nearly half the time
  • You can expect additional support costs to cover users who have forgotten

These lists make good sense, and are excellent conversation fodder among IT professionals. But where do the pros and cons meet in the middle as a "best practice?"

I am interested in the conclusions from studies on the topic, as opposed to personal opinion and anecdotes.

  • 2
    I'd like to see an analysis that identifies and tries to weigh up the competing factors. It takes time to learn new passwords and if users struggle, they will use notes. But the changes limit exposure time to compromised passwords. What is the balance. Is it more important to insist on strong passwords than to change frequently?
    – matt_black
    Commented May 17, 2012 at 22:51
  • 1
    emc.com/security/rsa-securid.htm (this password actually changes every minute).
    – Sklivvz
    Commented May 18, 2012 at 10:53
  • 1
    I am not sure what you mean with "authoritative detail". There are research papers linked in the answers. We do not have control over what questions are migrated to our site. I don't see a substantial difference between the original question and your question. Therefore it is unlikely that you will get different answers on this questions. Commented May 18, 2012 at 16:34
  • 1
    @HendrikBrummermann: The questions are fundamentally different. The older one asks how password rotation improves security--which is only one side of the coin, and is, in effect, asking for anecdotal evidence. Mine asks for best practices. Undeniably there is overlap, but I believe they are fundamentally different.
    – Flimzy
    Commented May 18, 2012 at 16:43
  • 1
    @HendrikBrummermann: There are two studies I can find linked in answers on the other question. One specifically about website passwords (relevant, but not comprehensive), and the other on whether rotation improves security against dictionary-type attacks. Both are useful, but neither points to a general best-practice.
    – Flimzy
    Commented May 18, 2012 at 16:45


Browse other questions tagged .