2

Referring to Why do I need a strong password for my home computer and How often should I change my Mac password, am I to safely assume that:

  1. Local passwords are, in fact, only for protecting against physical (ie. non-remote) access.
  2. One doesn't need to change the password like, ever, as long as it hasn't been compromised (ie. shared with someone, used elsewhere, etc.)

I personally use a Mac with FileVault and no SSH service running. I use various Wi-Fi networks (both at home and away). If the answer depends on the OS, please elaborate on why.

PS! Should the strength of a local password be stronger, weaker or the same as an online one?

1
  • Password must be always stronger following the Rule of Min length 8 with atleast 1 capital + 1 numerical + 1 special character within , be it local or an online one. Feb 25, 2018 at 14:55

2 Answers 2

1
  1. True, it only protects against physical access. But on portable corporate machines accessing corporate assets, it's a different ballgame as the local user authentication is probably also used to authenticate on the corporate domain when connected in some way to the corporate network. Let's say someone manages to read your username, domain and sees you typing your password connecting to a corporate laptop, they may not need physical access to that particular laptop to access the corporate network using the "stolen" credentials.

  2. True. In fact, I would argue that encouraging users to change their local machine password too often would likely reduce password security as users tend to get tired to remember new passwords every 30/60/90 days. As a result, new passwords are very likely to be variations of previous ones, noted down, or simply weak.

  3. Both local and online passwords should be made really strong, because although attack vectors may vary, ultimately you want both passwords to be resistant to brute forcing and dictionary attacks.

0
  1. If your Mac is running an SSH service, its better to change your password often.
  2. If you lose your Mac, File vault can be broken with brute force or dictionary attack.So it is adviced to have a strong password.

True, people are enforcing security policies more out of paranoia rather than actual requirement :)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .