This question is quite basic, but it bugs me and I'm sure it bugs a lot of other people as well.
What is the real security benefit to forcing users to change their password say every 60 days or every 90 days?
- Compromised credentials are useless after a short period of time.
- User resorts to easily remembered password increment schemes—password1, password2, passwordN.
- User is forced to expose passwords on other mediums to recall them—post-it note, other devices, etc.
- User has to reference exposed passwords increasing vectors for attack, as compared to a recalled-from-memory password.
It seems there are more drawbacks than benefits, so why is this security practice so prevalent?
Update from FTC article which shares some of my concerns:
The Carleton researchers also point out that an attacker who already knows a user’s password is unlikely to be thwarted by a password change. As the UNC researchers demonstrated, once an attacker knows a password, they are often able to guess the user’s next password fairly easily. In addition, an attacker who has gained access to a user’s account once may be able to install a key logger or other malware that will allow them to continue to access the system, even if the user changes their password.
Similarly, they share the same hypothesis.
While we don’t yet have a controlled study demonstrating the impact of password expiration policies on user behavior, there is quite a bit of evidence to suggest that these policies may be counterproductive.