April 27th, 2006


Spaf says: periodic password changes don't help

Computer security guru Gene Spafford, in a column titled "Security Myths and Passwords, states:

"In summary, forcing periodic password changes given today’s resources is unlikely to significantly reduce the overall threat....

"Back in the days when people were using mainframes without networking, the biggest uncontrolled authentication concern was cracking. Resources, however, were limited. As best as I can find, some DoD contractors did some back-of-the-envelope calculation about how long it would take to run through all the possible passwords using their mainframe, and the result was several months. So, they (somewhat reasonably) set a password change period of 1 month as a means to defeat systematic cracking attempts. This was then enshrined in policy, which got published, and largely accepted by others over the years. As time went on, auditors began to look for this and ended up building it into their “best practice” that they expected. It also got written into several lists of security recommendations.

"This is DESPITE the fact that any reasonable analysis shows that a monthly password change has little or no end impact on improving security!"

I've been increasingly annoyed by password policies that require strong (i.e. hard-to-remember) passwords and frequent password changes. Such policies invariably force users into writing passwords down or otherwise recording them, which makes them more vulnerable, not less.

Read the whole article.