Microsoft Says Forced Password Resets Don’t Improve Security

Microsoft Says Forced Password Resets Don’t Improve Security

Anyone who has spent more than a few weeks working in a corporate environment has dealt with the frustration of mandatory password changes. However, those days may finally be coming to an end. In a recent blog post, Microsoft admitted that compulsory password changes don’t enhance security and may actually make enterprise networks less secure.

For decades, the baseline password practices Microsoft provided to customers suggested forcing employees to change their passwords every 60 days. According to Microsoft’s Aaron Margosis, that technique is an “ancient and obsolete mitigation of very low value.” It comes from an era in which people might share passwords, and in time, a password might leak out of the organization. Today’s password breaches happen at the speed of light as malicious actors steal data and use GPUs to guess passwords. Assuming that a password is stolen, isn’t 60 days a rather long time to allow the thief to use it anyway? Anyone who’s going to do real damage will have done it long before the password reset rolls around.

When you force users to change passwords frequently, they’re likely to choose passwords that are easy to remember. Research shows that such passwords are probably the easiest to crack in the event someone steals a hashed database and unleashes an army of GPUs on it. For example, people use dictionary words with numbers substituted for similar looking letters. If you make them change that password, they’ll probably just make predictable changes that are just as easy to crack.

Microsoft Says Forced Password Resets Don’t Improve Security

Margosis says that implementing requirements like banned-password lists, multi-factor authentication, detection of password-guessing attacks, and detection of anomalous login attempts make forced password resets obsolete. Passwords are inherently problematic for security, so making people choose more bad passwords isn’t the best approach. Margosis points out that Microsoft is not changing its guidelines on password length, complexity, or history. The most robust passwords are randomly generated, and the longer they are, the better.

While Microsoft will stop telling organizations to force password resets, it won’t be taking its own advice right away. The password reset timer in Windows Server products is still 42 days. It wouldn’t be surprising if Microsoft changes that default in future versions, though. Nevertheless, IT workers who want to do away with tedious and unnecessary password resets will have something to show higher-ups to help make their case.

Continue reading

Don’t Miss This Week’s Great Conjunction of Jupiter and Saturn
Don’t Miss This Week’s Great Conjunction of Jupiter and Saturn

The two planets will appear closest together on Monday, December 21, the day of the Winter Solstice, when—depending on your eyesight—they may seem to briefly merge into a single bright point of light before drawing apart again.

Google, Microsoft, and Qualcomm Don’t Want Nvidia to Buy ARM
Google, Microsoft, and Qualcomm Don’t Want Nvidia to Buy ARM

When Nvidia declared its intention to buy ARM, it sent shockwaves through the entire ecosystem. Google, Microsoft, and Qualcomm are particularly concerned, and one of them is said to openly oppose it.

Deep Space Nine Project Update: Why MakeMKV-Derived Files Don’t Work
Deep Space Nine Project Update: Why MakeMKV-Derived Files Don’t Work

The question of why a MakeMKV source doesn't work has come up again and again, so we decided to investigate it.

Cyberpunk’s Big Next-Gen Update Is Here, but Don’t Get Your Hopes Up
Cyberpunk’s Big Next-Gen Update Is Here, but Don’t Get Your Hopes Up

If you've been waiting to enjoy Cyberpunk on your next-gen console, now is the time.