797 points by Tomte 1776 days ago | 424 comments on HN
| Mild positive Editorial · v3.7· 2026-02-28 12:26:17
Summary Cybersecurity & Privacy Advocates
The article reports on Microsoft's policy shift away from mandatory periodic password changes, grounded in security research showing such practices harm security and user behavior. The content engages primarily with Articles 3 (personal security through effective practices), 12 (privacy protection via password strength), 19 (informed public discourse), 26 (security education), and 27 (scientific research), advocating evidence-based cybersecurity approaches that respect human dignity and actual threat protection.
I welcome websites removing mandatory password rotation. And it's true that rotating passwords doesn't necessarily reduce the chances of having it brute-forced. But that's not the point of changing passwords every so often. Rotating passwords is useful because a security vulnerability in the site or some mistake on your part can get the password exposed. You're not trying to protect yourself against super hackers (that's the website's responsibility), but against your own mistakes.
It's no longer a recommended industry standard, but unfortunately, it is still basically required, because many compliance policies have not updated. I would be shocked if at least some of Microsoft is still required to employ password rotation policies because of their own compliance requirements.
At least one policy I am looking at maintains the 90 day rotation requirement if you use basic password authentication, but offers alternative options for compliance with other authentication features. But even most of those tend to have yearly rotation requirements.
The article kinda misses the reason why mandatory password changes existed in the first place -- unknown breaches. The idea was that if there was an undetected breach, the attacker would have a maximum of the mandatory password change to use credentials. You would still have mandatory password changes upon discovering a breach, which would reset the counter. And the article wasn't very clear as to why this is no longer recommended, but when mandatory password changes are enforced, users tend to make new passwords which are trivial to crack if you have a known old password. So if there's an unknown (or even known) breach, users will tend to make a new password which an attacker can easily guess given the older known passwords, losing any benefit gained from mandatory password changes. And this is worse than not having mandatory password changes, because rare password changes (when a breach is discovered) don't put people into the habit of just iterating off of an old password.
The company I work for is one of the large(est) “FinTech” conglomerates. After talking to a lot of our security folks they agree about not changing passwords but are unable due to PCI and Federal standards/audits.
We have to adhere to outdated security practices simply because the auditors will flip out and the documented controls in government mandates. Section “10.12.3.4” says you must rotate passwords.
Mandatory password changes never made any sense. It's especially terrible when systems don't allow users to re-use previous passwords.
It forces users to keep inventing new passwords which they can never remember, then they end up writing the passwords on post-it-notes and sticking them on their computer screens where everyone can see.
Same issue with forcing people to use special characters in their passwords; it makes people choose passwords that they can't remember.
I've used systems where the situation became so out of control that I literally had to go through the entire 'forgot your password' (reset password) flow every single time I wanted to log in. That was the fastest way for me to log into that service.
Microsoft has been saying this since before FTA, but nobody seems to have told corporate IT. When I was there (2015-2019), we had to change our passwords every six months.
I believe this has been Microsoft's guidance as far back as 2016, with the caveat of using Azure AD risk analysis /MFA.[1]
>Password expiration policies do more harm than good, because these policies drive users to very
predictable passwords composed of sequential words and numbers which are closely related to each
other (that is, the next password can be predicted based on the previous password). Password change
offers no containment benefits cyber criminals almost always use credentials as soon as they
compromise them.
>Mandated password changes are a long-standing security practice, but current research strongly
indicates that password expiration has a negative effect. Experiments have shown that users do not
choose a new independent password; rather, they choose an update of the old one. There is evidence to
suggest that users who are required to change their passwords frequently select weaker passwords to
begin with and then change them in predictable ways that attackers can guess easily.
>One study at the University of North Carolina found that 17% of new passwords could be guessed given
the old one in at most 5 tries, and almost 50% in a few seconds of un-throttled guessing. Furthermore,
cyber criminals generally exploit stolen passwords immediately.
Agreed - there's so much I find frustrating about how companies manage passwords in addition to mandatory changing.
- Maximum length requirements (often secret until you try to put a password in)
- Requiring some symbols, but not others
- Silent truncation of the the password without telling you
- Failure because the password is too long, but the error says something else (like missing symbol)
This isn't just small unknown companies either. If you use a password longer than 32chars in Zoom when creating your account it just truncates the remaining without telling you. Login works on the websites, but if you try to login via the client it fails. If I manually backspace to 32chars it works. I tried to tell it to their US Twitter support and they just kept sending me a password reset link so I gave up (they're a bad company anyway [0]). Tmobile's website used to do the same thing, except worse because it would truncate on creation but not on validation.
How is this not standardized in some sane way?
An old credit union I was part of in NY (SEFCU) mandated passwords with exactly 6 characters. When I complained about this I was told it was secure because they forced one of the characters to be a symbol.
> Microsoft employee Aaron Margosis said the requirement is an “ancient and obsolete mitigation of very low value.”
That kind of magical thinking is what got us mandatory password rotation in the first place.
Password rotation has a kernel of truth: automated credential rotation really works, and sometimes you need to force manual rotations to migrate to a newer hash algorithm, and I'll bring up another reason for it.
But the main reason we have password rotation is people have some magical belief that a credential gets "old" so we have to freshen it up.
Security rules are the same: they work, or they don't, and that can be very complicated due to human factors. But they don't "get old" and magically lose their effectiveness. If password rotation is broken, it's always been broken.
> Chief among them, the requirements encourage end users to choose weaker passwords than they otherwise would. A password that had been “P@$$w0rd1” becomes “P@$$w0rd2” and so on.
Not true. If they hadn't been forced to rotate, they would have stuck with P@$$w0rd1 the whole time, and P@$$w0rd2 is not weaker than that.
> At the same time, the mandatory changes provide little security benefit, since passwords should be changed immediately in the event of a real breach rather than after a set amount of time prescribed by a policy.
There is a clear benefit, especially for large enterprise systems: a periodic password change does put a limit on when the attacker could have used the password.
So when a credential is exploited, if you're rotating yearly, you only need to search back at most a year to figure out the scope of the breach.
I don't know how much of a benefit this is, in practice. Maybe someone who has done a real log dive can comment.
The only certainty is that you must never have passwords older than logs.
> If it’s a given that a password is likely to be stolen, how many days is an acceptable length of time to continue to allow the thief to use that stolen password?
I knew an old hack IT guy who had a spreadsheet full of users passwords which he obtained through demanding them when their computers needed fixing. Rotation dealt with that particular issue!
Then somewhere else I read an IT policy that said 'You will be assigned a password by IT, do not change it.'
I have seen numerous cases of IT support asking users passwords to make fixing a machine more permanent. I have seen more than one where they kept that record.
I have also seen lots of cases of, 'I have their passwords so I can log in to their email when they are away'. We know it is stupid, but these smart people didn't.
That is why I still rotate passwords, I know some will be compromised internally. I do it on a slow schedule though.
And yet, there are Fortune 100 financial institutions that require their vendors to have a policy of mandatory 30 day rotation for sysadmins and 90 days for non-privileged persons. Companies that don't have and enforce said policy are unqualified for the privilege of vendorhood. Pointing out this Microsoft paper, the NIST guidelines, or the NCSC guidelines will just get the subcontracted droids giving you a negative mark on your annual vendor security assessment.
No, I am not jaded or bitter on this topic. Why do you ask?
Rotating passwords every so often is good advice, and I find it unlikely to discover a good reason not to.
With a password manager, this process is pretty painless, if not automatic.
Mandating it for my Hello Kitty: Island Adventure account seems a bit heavy-handed though.
Rather than pulling back the recommendations, we should really be implementing open standards for automatic rotations that don't rely on reverse engineering / implementing various third party reset password flows.
Isn't it weird when all of us individually knew forced password change is more harm than benefit, but it took literally decades for this to become institutionally admitted?
Just imagine, maybe a subset of neurons inside your brains have amazing ideas that could change your life, but it might take decades (or never) for them to surface to the conscious level where you realize "oh, I have an idea".
How to make sure organizations are not less than the sum of their parts?
I would go further: "passwords are ancient and (should be) obsolete".
If you can don't rely on passwords, use hardware security keys and protocols like U2F and other FIDO2 related protocols. Sure you might still have a pin, but now you rely much less on it so it can be much simpler.
If you can't use word phrases instead of passwords, e.g. 4 randomly selected words, and yes randomly selected for the user, not choose by the user. But with a way to "re-roll" when setting the pass phrase.
As a side effect of being more secure (then normal remembered passwords) and easier to remember. As a benefits they are also easier to insert on phones with swipe keyboards and have some nice tricks wrt. internationalization you could use. (Make sure they
still work with password managers.)
Practically maybe not possible currently, but if you already rely on a password manager there is technical very little reason not to replace passwords with a U2F/FIDO like process connecting to the password manager. This might be less secure than a HSK but still nice. Ah, anyway that's currently not a think.
Lastly if your service isn't generally "security sensitive" and login sessions tend to be long consider login links send to your password reset email. Especially if combined with password-less fido auth based on the browser + TPM this can be a nice approach (you use password-reset-like links to setup password-less fido auth on the given device).
Tbh I don't trust passwords to keep my accounts save, it's 2FA all the way.
Passwords have this nasty tendency to get leaked, one of my older e-mail accounts is listed in 12 different breaches on haveibeenpwned.com
And while the ideal is not to reuse passwords, keeping that practice up with the number of accounts that are nowadays required with a somewhat digital lifestyle is kind of impossible, short of using a password manager.
But then you are locked into a password manager and gotta hope it works on all the devices you gonna need your passwords on or else you will be stuck manually putting in long and complex passwords.
I blame Microsoft for most of the password policies my company implemented years ago and won't change. Mandatory password changes included.
While on my soapbox, I'd like to tell them that it's really dumb to count multiple attempts of the same password individually and then lock you out after you attempt the same password three times. And your most recent password should count as zero attempts. These kinds of dumb policies only hurt legitimate users and do nothing to improve actual security.
Best password policy I ever lived under was the graduate computer lab at the university. The admins just left a password cracker running continuously, and when it got your password, it was time to change it.
Yeah, I think there's value in it, but if you don't have a way to prevent "plus one passwords", it probably isn't super effective anyways. It may be a case where frustrating the user four times a year isn't worth it... maybe just frustrating them once a year will lead people to put more effort into making their passwords suitably different.
A better focus for security efforts is detection of compromise. For example, say you detect a user has signed in from 2 different countries in a short window or perhaps malware signs are discovered in their cloud storage. Perhaps MFA is failing often for a user meaning an attacker is successfully using a password but is unable to get past confirmation on the user's phone.
I can't honestly think of any website that enforces password rotation. Except for corporate application websites, which I would consider application's that fall under my companies password security regime.
I wouldn't want to image a world where every website would force me to rotate my password, each with it's own interval and method. Imagine the upkeep time cost.
do attackers wait to use passwords months after they've compromised those passwords? or, do they give themselves other ways to maintain their access so that no passwords stand in their way from that point on?
it's the latter, not the former. once you're compromised, passwords, changed or not, are no longer an obstacle at all.
Mandatory password rotation does help in one place - when passwords to an account are shared.
So if Microsoft Employees 1,2,3 share a password to Vendor X's system, and employee 2 moves to another part of the company or leaves, the shared password will eventually change and employee 2 won't know it anymore.
Actually the fastest possible way to detect unknows breaches on the user side is to show your last login time. (On the server side is looking for IP patterns)
My favorite is silent truncation on the signup page but not on the login page.
> I paste in my password. It gets cut off to N characters by the form.
> I paste that same password on the login page. There is no character limit on the login form.
> Silent truncation of the the password without telling you
Bonus points for truncating the password differently in the login form and the password change form. Now you can't login anymore!
> Failure because the password is too long, but the error says something else (like missing symbol)
A few years ago the local City government in Paris put out some new app to pay for parking. You'd have to create an account and give them your credit card[0]. When I say they had some ridiculous maximum password length, something like 8 characters, I decided that I could actually take the five minutes to pay in person.
I haven't tried the app ever since, so no idea if this crazy limitation is still in effect.
---
[0] There was no option to give the credit card on each payment, they had to save it on file. Of course, they weren't aware that local banks were rolling out credit cards with changing verification codes, so some cards would've had to be re-entered anyway...
> An old credit union I was part of in NY (SEFCU) mandated passwords with exactly 6 characters. When I complained about this I was told it was secure because they forced one of the characters to be a symbol.
For a bank?! And here I am complaining that Chase doesn't support application-based OTP. I hope you ran far far away from that CU.
Schwab used to do the "silently truncate to 8 chars" fail, but they _also_ silently changed all chars to upper/lower so the password was case insensitive.
Still can't believe they were allowed to have such a bad and secret password policy for so long.
Is this similar to Enigma decoding - whereby the 'encoding' key was reasonably predictable and not random due to new keys being required to be generated regularly?
A shitty local bank back home truncated without telling you as well. Didn't realize it until they rolled out a mobile app and my password didn't work. After complaining about it, a friend who worked at said bank as a teller said to try truncating to 8 chars and it worked. :rage:
Apparently it was known internally, as they used some ancient system behind the scenes that would only support a max of 8 chars, and the website just truncated your password and passed that on. The new app didn't truncate and would get an error response.
I should add that a password which you actually need to remember, like the master password to a password manager, should never be used online. The more isolation you can maintain the better. This way offline attacks against stolen hashes are unlikely to find anything, since they will only contain randomly generated passwords.
> These policies drive users to very predictable passwords
I used to do a lot of contract work for the Clarke County School District in Athens, GA. For "security" reasons they weren't able to create domain accounts for people who weren't full time employees, so I'd often have to track down the IT manager to gain access to servers I was working on.
He eventually got sick of having to drop what he was doing a dozen times a day, so one day he just gave me his password: a dictionary word followed by the number 23. Eventually the password failed, and he gave me his new password: that same dictionary word followed by a 24.
Fast forward a few years and I'm back installing some updates, and before I get to work he hands me a slip of paper, on which he had written Dictionaryword29.
Rotating (or required change) on some circumstantial criterion (the old password is know or suspected to be compromised, system update, etc.) is entirely valid.
Forced scheduled frequent password updates are not and worsen rather than improve security. That's the point here.
In environments in which data leakage probability is high, and detection capabilities poor, periodic password changes are a defensible risk-mitigation measure, though in practice unless new tokens are themselves robust, the practice backfires. The problem is that both sides of the risk calculus need to be considered --- compromised token validity period, and token strength. People being people, the first is actually the safer risk to take.
The fact that all of those are created to circumvent some other stupid and baseless security policy speaks loudly. (Except the second, that one is the policy itself.)
Recently had a long discussion over email with an executive security officer of my company regarding this topic. Their conclusion was basically "until the standards change this is how it will be".
> Isn't it weird when all of us individually knew forced password change is more harm than benefit, but it took literally decades for this to become institutionally admitted?
The US bank I recently opened an account with (in 2021) is in the S&P 500, publicly traded. The only form of 2FA they support is SMS or some proprietary hardware keychain LCD thing they don't give out for free (which I assume is the M+A great grandchild of those RSA TOTP fobs that were the fad in the 90s).
It's not weird. Most security organizations are wholly incompetent, doing cargo cult security nonsense "because that's the way we've always done it".
It’s worth noting that MFA solves credential sprays but not targeted phishing
Editorial Channel
What the content says
+0.50
Article 3Life, Liberty, Security
High Advocacy Coverage
Editorial
+0.50
SETL
+0.50
Article directly advocates for security practices that meaningfully protect personal security against real attacks. Cites research on attack vectors (dictionary attacks, graphics-card-accelerated cracking) and recommends 11+ character random passwords as effective countermeasure.
FW Ratio: 50%
Observable Facts
Article states: 'Researchers have increasingly come to the consensus that the best passwords are at least 11 characters long, randomly generated, and made up of upper- and lower-case letters, symbols, and numbers.'
Article reports Microsoft now recommends against mandatory periodic changes because 'passwords should be changed immediately in the event of a real breach rather than after a set amount of time.'
Inferences
The advocacy for evidence-based security practices grounded in actual attack techniques demonstrates commitment to meaningful personal security.
Shifting from prescriptive time-based rules to breach-response rules reflects prioritization of actual threat protection over tradition.
+0.50
Article 27Cultural Participation
High Coverage
Editorial
+0.50
SETL
ND
Article extensively cites and discusses scientific research on password security, presenting expert consensus and research findings as basis for policy change.
FW Ratio: 67%
Observable Facts
Article states: 'Researchers have increasingly come to the consensus that the best passwords are at least 11 characters long, randomly generated, and made up of upper- and lower-case letters, symbols, and numbers.'
Article notes: 'Recent scientific research calls into question the value of many long-standing password-security practices, such as password expiration policies.'
Inferences
The article's substantial engagement with scientific research findings and expert consensus contributes to public understanding and application of scientific advancement in security practices.
+0.40
Article 12Privacy
High Advocacy Coverage Practice
Editorial
+0.40
SETL
+0.45
Article positions strong password security as foundational to privacy protection, advocating for practices that prevent unauthorized account and data access.
FW Ratio: 50%
Observable Facts
Article establishes that strong passwords prevent 'unauthorized use' of accounts and protect user information from theft.
Website restricts some content to paying subscribers via paywall; content analytics may involve user tracking.
Inferences
The article's advocacy for security practices that prevent unauthorized access demonstrates commitment to privacy protection.
The paywall structure that restricts access to privacy-related content conflicts with universal right to privacy education.
+0.30
Article 19Freedom of Expression
High Coverage Practice Framing
Editorial
+0.30
SETL
+0.35
Article presents research-based arguments and expert perspectives (Microsoft, FTC, security researchers) freely, supporting informed public discussion of security policy.
FW Ratio: 60%
Observable Facts
Article quotes Microsoft employee Aaron Margosis, references Lorrie Cranor's FTC position from 2016, and cites 'scientific research' on password security.
Article page includes comment count (265 comments) and comment functionality enabling reader expression.
Website restricts article access to subscribers, limiting ability to freely discuss content.
Inferences
The multi-perspective presentation of evidence-based arguments supports informed expression and public discourse on information security.
Comments functionality enables freedom of expression, though paywall may limit participation by excluding non-subscribers.
+0.30
Article 26Education
High Coverage
Editorial
+0.30
SETL
ND
Article educates readers about password security research, attack methodologies (dictionary attacks, graphics-card acceleration, pattern modification), and evidence-based best practices.
FW Ratio: 67%
Observable Facts
Article explains: 'Hackers have mined real-world password breaches to assemble dictionaries of millions of words. Combined with super-fast graphics cards, the hackers can make huge numbers of guesses in off-line attacks.'
Article details how users defeat password security: 'When humans are forced to change their passwords, too often they'll make a small and predictable alteration to their existing passwords.'
Inferences
The detailed explanation of attack techniques and security principles educates readers about digital security literacy and research findings.
+0.20
PreamblePreamble
Medium Framing
Editorial
+0.20
SETL
ND
Article frames evidence-based cybersecurity policy as superior to prescriptive mandates, reflecting respect for human judgment and rational governance.
FW Ratio: 50%
Observable Facts
Article attributes Microsoft's policy change to research showing mandatory password changes encourage weak passwords and provide 'little security benefit.'
Inferences
The emphasis on respecting human capacity to make informed security choices and prioritizing actual security outcomes over traditional rules reflects commitment to human dignity.
+0.20
Article 25Standard of Living
Medium Coverage Advocacy
Editorial
+0.20
SETL
ND
Article frames password security as essential to protecting user accounts and personal information in contemporary digital life, contributing to adequate standard of living.
FW Ratio: 50%
Observable Facts
Article discusses security practices as essential to protecting personal information and accounts from unauthorized access and theft.
Inferences
Digital security practices are increasingly part of adequate standard of living in digitally interconnected society.
+0.10
Article 1Freedom, Equality, Brotherhood
Low Coverage
Editorial
+0.10
SETL
ND
Article discusses security best practices that apply universally to 'end users' as a class, with equal concern for all users' security outcomes.
FW Ratio: 50%
Observable Facts
Article addresses security guidance for 'end users' generally without differentiation of status or background.
Inferences
The universal framing of password security principles suggests equal concern for security across all users regardless of position.
+0.10
Article 8Right to Remedy
Low Coverage
Editorial
+0.10
SETL
ND
Article mentions breach response as proper remedy context, noting passwords 'should be changed immediately in the event of a real breach.'
FW Ratio: 50%
Observable Facts
Article states: 'When passwords or their corresponding hashes are stolen, it can be difficult at best to detect or restrict their unauthorized use.'
Inferences
The discussion of breaches and proper response procedures indicates engagement with remedy when security violations occur.
+0.10
Article 21Political Participation
Low Coverage
Editorial
+0.10
SETL
ND
Article reports corporate policy changes affecting user security practices, enabling public awareness and informed discussion of policies that affect them.
FW Ratio: 50%
Observable Facts
Article reports Microsoft's removal of mandatory password changes from official security baseline recommendations, a corporate decision affecting millions of users.
Inferences
Reporting on corporate policy changes enables democratic awareness of decisions affecting public security practices.
ND
Article 2Non-Discrimination
Not directly engaged.
ND
Article 4No Slavery
Not engaged.
ND
Article 5No Torture
Not engaged.
ND
Article 6Legal Personhood
Not engaged.
ND
Article 7Equality Before Law
Not engaged.
ND
Article 9No Arbitrary Detention
Not engaged.
ND
Article 10Fair Hearing
Not engaged.
ND
Article 11Presumption of Innocence
Not engaged.
ND
Article 13Freedom of Movement
Not engaged.
ND
Article 14Asylum
Not engaged.
ND
Article 15Nationality
Not engaged.
ND
Article 16Marriage & Family
Not engaged.
ND
Article 17Property
Not engaged.
ND
Article 18Freedom of Thought
Not engaged.
ND
Article 20Assembly & Association
Not engaged.
ND
Article 22Social Security
Not engaged.
ND
Article 23Work & Equal Pay
Not engaged.
ND
Article 24Rest & Leisure
Not engaged.
ND
Article 28Social & International Order
Not engaged.
ND
Article 29Duties to Community
Not engaged.
ND
Article 30No Destruction of Rights
Not engaged.
Structural Channel
What the site does
0.00
Article 3Life, Liberty, Security
High Advocacy Coverage
Structural
0.00
Context Modifier
ND
SETL
+0.50
Website operates with standard security infrastructure; no unique structural contribution to personal security observed on this article.
-0.10
Article 12Privacy
High Advocacy Coverage Practice
Structural
-0.10
Context Modifier
ND
SETL
+0.45
Website implements paywall restricting access to security and privacy content; user data may be tracked for analytics and advertising.
-0.10
Article 19Freedom of Expression
High Coverage Practice Framing
Structural
-0.10
Context Modifier
ND
SETL
+0.35
Website enables reader expression through comments section (265 visible), but paywall limits participation and visibility for non-subscribers.
ND
PreamblePreamble
Medium Framing
Not applicable.
ND
Article 1Freedom, Equality, Brotherhood
Low Coverage
Not applicable.
ND
Article 2Non-Discrimination
Not directly engaged.
ND
Article 4No Slavery
Not engaged.
ND
Article 5No Torture
Not engaged.
ND
Article 6Legal Personhood
Not engaged.
ND
Article 7Equality Before Law
Not engaged.
ND
Article 8Right to Remedy
Low Coverage
Not applicable.
ND
Article 9No Arbitrary Detention
Not engaged.
ND
Article 10Fair Hearing
Not engaged.
ND
Article 11Presumption of Innocence
Not engaged.
ND
Article 13Freedom of Movement
Not engaged.
ND
Article 14Asylum
Not engaged.
ND
Article 15Nationality
Not engaged.
ND
Article 16Marriage & Family
Not engaged.
ND
Article 17Property
Not engaged.
ND
Article 18Freedom of Thought
Not engaged.
ND
Article 20Assembly & Association
Not engaged.
ND
Article 21Political Participation
Low Coverage
Not applicable.
ND
Article 22Social Security
Not engaged.
ND
Article 23Work & Equal Pay
Not engaged.
ND
Article 24Rest & Leisure
Not engaged.
ND
Article 25Standard of Living
Medium Coverage Advocacy
Not applicable.
ND
Article 26Education
High Coverage
Not applicable.
ND
Article 27Cultural Participation
High Coverage
Not applicable.
ND
Article 28Social & International Order
Not engaged.
ND
Article 29Duties to Community
Not engaged.
ND
Article 30No Destruction of Rights
Not engaged.
Supplementary Signals
How this content communicates, beyond directional lean. Learn more
build aba2bc8+myve · deployed 2026-02-28 16:36 UTC · evaluated 2026-02-28 16:29:11 UTC
Support HN HRCB
Each evaluation uses real API credits. HN HRCB runs on donations — no ads, no paywalls.
If you find it useful, please consider helping keep it running.