Password expiration is dead
Recent scientific research calls into question the value of many long-standing password-security practices such as password expiration policies, and points instead to better alternatives such as enforcing banned-password lists and MFA.
- from
- IAM
- added
- 2026-10-10
- likes
- 0
similar
-
Practical Recommendations for Stronger, More Usable Passwords andrew.cmu.edu
This study recommend the association of: blocklist checks against commonly leaked passwords, password policies without character-class requirements, minimum-strength policies.
-
Banks, Arbitrary Password Restrictions and Why They Don't Matter troyhunt.com
“Arbitrary low limits on length and character composition are bad. They look bad, they lead to negative speculation about security posture and they break tools like password managers.”
-
An argument for passwordless web.archive.org
Passwords are not the be-all and end-all of user authentication. This article tries to tell you why.
-
Breaking Password Dependencies: Challenges in the Final Mile at Microsoft youtube.com
The primary source of account hacks is password spraying (on legacy auth like SMTP, IMAP, POP, etc.), second is replay attack. Takeaway: password are insecure, use and enforce MFA.
-
How to change the hashing scheme of already hashed user's passwords news.ycombinator.com
Good news: you're not stuck with a legacy password saving scheme. Here is a trick to transparently upgrade to stronger hashing algorithm.
-
Your Pa$$word doesn't matter techcommunity.microsoft.com
Same conclusion as above from Microsoft: “Based on our studies, your account is more than 99.9% less likely to be compromised if you use MFA.”
IAM › Password-based auth: “Recent scientific research calls into question the value of many long-standing password-security practices such as password expiration policies, and points instead to better alternatives such as enforcing banned-password lists and MFA.”