[153604] in North American Network Operators' Group
Re: Dear Linkedin,
daemon@ATHENA.MIT.EDU (John Levine)
Fri Jun 8 17:59:52 2012
Date: 8 Jun 2012 21:59:20 -0000
From: "John Levine" <johnl@iecc.com>
To: nanog@nanog.org
In-Reply-To: <B29F2800-9345-4A74-B90A-6C8A92BBA463@gmail.com>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
>Yes; of course if most of those accounts are moribund and unused then you don't need
>to change them so often, but the passwords you use frequently should be changed at
>regular intervals.
>
>It's pretty commonsensical once the threat is understood.
Given that most compromised passwords these days are stolen by malware
or phishing, I'm not understanding the threat, unless you're planning
to change passwords more frequently than the interval between malware
stealing your password and the bad guys using it.
I agree that keeping a big file of unsalted hashes is a dumb idea, but
there isn't much that users can do about services so inept as to do
that.
R's,
John
