On Mon, Jul 15, 2024 at 12:35 PM Barry <barry@xxxxxxxxxxxxxxxx> wrote: > > > On 15 Jul 2024, at 11:08, Patrick O'Callaghan <pocallaghan@xxxxxxxxx> wrote: > > > > IIRC it dates from decades ago when most people had only one login, if > > that, and it was typically to a mainframe. > > It was made popular in the PC era by a security researcher, sorry don’t have a ref to his name. Password rotation and complexity policies originated in WIndows NT 4. They were not based on science. Microsoft pulled them out of their ass or read them from tea leaves. Then, NIST picked them up from Microsoft and made them a Special Publication based on faith. Thankfully, NIST changed the requirements back in 2017 or so. But organizations are still doing the old brain-dead stuff, like forcing gratuitous password changes and enforcing complexity requirements. > But a few years ago the same researcher said that the advice was a bad idea and showed the amount of money the USA wasted each year on forcing millions of people to change passwords. He compared that cost against all cyber loses in a year. > The password change costs where far higher. You are correct - rotation and complexity leads to a weaker system, and not a more secure system. For all the details (with academic citations), see Peter Gutmann's Engineering Security, <https://www.cs.auckland.ac.nz/~pgut001/pubs/book.pdf>, Chapter 7. Here's a spoiler from the book: Passphrases need more study. Passphrases are believed to be stronger than passwords. However, in at least 25% of the cases, passphrases are weaker than passwords. And another spoiler from the book: Security Questions are insecure. No one should be using them nowadays. We've known they are insecure for 15 or 20 years or so. Jeff -- _______________________________________________ users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
