It is frequently reccomended that people change their passwords periodically for security reasons. Some systems even force users to change their passwords at fixed intervals.
Now, what benefit does changing passwords give? Obviously, if a user knows/suspects that someone has acquired its password, then a password change will lock out the intruder. However, a clever intruder could have used that access to trojan the system, making the password change irrelevant. This is especially true for root-level accounts.
The only other reason for changing passwords would be to make guessing harder. If an attacker is trying to determine a password with a brute-force attack (using a dictionary, a random string generator, or whatever), then it can expect to find the password after exhausting 1/2 of its search space. Since the user has no way of knowing in what order the attacker is processing the search space, changing passwords might increase the search distance between the password and the attacker's current search point, but has an equal change of decreasing it. Thus, there is no net benefit.
If a user knowns when an attacker started a brute-force attack, and at what rate it is progressing, then there may be some benefit to changing passwords. If the search order is known, then changing the password to something already tested is beneficial, as the attacker will not find the password on the current brute-force run. If the search order is not known, then changing the password after K% of the search space has been processed will reduce the attacker's chances of finding the password to 100-K%, assuming that the attacker hasn't found it already. Since the attacker has a K% chance of already having found it before the change, this isn't a very good defense, but it is something.
However, in real life, no user is going to know when a brute force attack begins or the search rate. If you assumed that the attack began before it did, the benefit to the user is reduced. If you do know the search order, you could actually tip the chances in the attacker's favour. If the attack hasn't started yet, then the benefit is zero. If you assume that the attack began after it did, then changing the password also reduces the benefit to the user, because the chance that the attacker already has the password is increased.
So, without accurate knowledge of when the attacker started and how quickly it is searching, the actual benefit of changing passwords is minimal. Of course, if the attacker knows that you're going to do this, then it can adapt its search method to compensate. Then, the user could adapt its prediction model accordingly. The whole thing reduces to an exercise in game theory.
Or did I miss something? Discuss. |
