Should passwords expire?
I have a 2-part answer because this deals with User Experience and Security, but first things first :
The answer is, yes!
I'll do the User Experience side of things first since that's the site we are on. This has been demonstrated by a very popular webcomic by xkcd everyone will probably recognize:
Now, let's test
correct horse battery staple on HowSecureIsMyPassword :
On a normal Desktop PC performing at 4 billion calculations per second, you get :
I know, you're saying,"Yea, but that's just a normal Desktop PC. What about something faster?"
OK. What about the world's fastest supercomputer that performs as 33,860 trillion calculations per second?
That's a really long time! Impossible!
You must be saying, "Well hold on! Wait a minute! What about the other
Tr0ub4for&3 password in the comic strip? Surely, it would take a long time to crack that too, right?"
Ok, let's see what China does with that!
Just 4 hours!?!?!
Yup! Just remember :
Length and easy to remember > complexity!
Now, it is true, you need to also remember, two-factor authentication is the way to go nowadays and Clef has an awesome setup in that direction.
Now, as far as Security side of this, this specific question has already been question asked (different wording, but roundabout the same thing) by Bill the Lizard♦ on Security.SE :
How does changing your password every 90 days increase security?
It might be noteworthy to that in his question, he edited it to state :
This question was IT Security Question of the Week.
Read the Jul 15, 2011 blog entry for more details....
This was the accepted answer from Justin Cave that Bill the Lizard♦ chose :
The reason password expiration policies exist, is to mitigate the problems that would occur if an attacker acquired the password hashes of your system and were to break them. These policies also help minimize some of the risk associated with losing older backups to an attacker.
For example, if an attacker were to break in and acquire your shadow password file, they could then start brute forcing the passwords without further accessing the system. Once they know your password, they can access the system and install whatever back doors they want unless you happen to have changed your password in the time between the attacker acquiring the shadow password file and when they are able to brute force the password hash. If the password hash algorithm is secure enough to hold off the attacker for 90 days, password expiration ensures that the attacker won't gain anything of further value from the shadow password file, with the exception of the already obtained list of user accounts.
While competent admins are going to secure the actual shadow password file, organizations as a whole tend to be more lax about backups, particularly older backups. Ideally, of course, everyone would be just as careful with the tape that has the backup from 6 months ago as they are with the production data. In reality, though, some older tapes inevitably get misplaced, misfiled, and otherwise lost in large organizations. Password expiration policies limit the damage that is done if an older backup is lost for the same reason that it mitigates the compromise of the password hashes from the live system. If you lose a 6 month old backup, you are encrypting the sensitive information and all the passwords have expired since the backup was taken, you probably haven't lost anything but the list of user accounts.
But to me, the best answer, and the one I voted up, was by Hendrik Brummermann♦ :
Before answering, whether it does help or it does not help, it makes sense to look at specific scenarios. (That's often a good idea when dealing with security measurements)
In what situations does a forced-password-change mitigate impact?
The attacker knows the password of a user but has no backdoor. He does not want to be discovered, so he does not change the password himself.
Let's see if this scenario is likely:
How might he have learned the password?
- The victim might have told him (e. g. a new intern who should start working before he gets his own account setup, another person who should level an account in an online game
- The attacker might have watched the keyword
- The attacker might have had access to another password database in which the user used the same password
- A one time only login using a computer owned (prepared) by an attacker.
What might have prevented him from setting up a backdoor?
- The service in question may not provide a way for backdoors, for example an email inbox or common web applications
- The privileges of the user may not have sufficient permission to install a backdoor
- The attacker might miss the required knowledge (in the online game Stendhal most "hacks" are done by angry siblings who just want to destroy some toy)
- The attacker might not have turned evil, yet. (e. g. an employee that will be fired next month but does not suspect anything at the moment).
Why not use forced password expire?
It can be very annoying to users causing them to just add a counter at the end. This might decrease the entropy of passwords. According to my experience it generates additional support costs because people forget their new password more often than usual. I guess that is caused by the change password prompt catching them off guard while they are busy thinking about something else.
It is far from a cure-all and it has a negative impact on usability, but it does make sense to balance that against the likelyhood and impact of scenarios similar to the one I described above.