This post was originally published in French only. We translated it in 2026 so the archive reads the same in both languages. Read the original →
As I discussed in a previous post (Password management… A new kind!), forcing password changes adds no value to security systems. Nobody has been able to figure out where this practice comes from or why it exists. The practice has become entrenched in the major security standards frameworks (ISO27k). Several studies have shown there is no correlation between rotation and security. Two-factor authentication will always be stronger than a single password. On top of that, adding a second factor makes it possible to relax the complexity and length requirements associated with a password. The example we have in our daily lives is the bank card, whose PIN would be rated weak by the password standards we use in the enterprise. Since the chip card is not easily cloned with current techniques, knowing the PIN alone doesn’t get you very far.
So, better use of two-factor authentication would ease the pain users feel when managing their passwords. On the web, there are notable efforts by Google (one time password) and Facebook (a warning when a new computer tries to log in, and a second factor by sending an SMS). In the enterprise, we are stuck with SecurID-type tokens and in some cases smart cards with X.509 certificates. Because of cost and deployment complexity concerns, these approaches are not very widespread.