Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We frequently see news stories about high profile security breaches such as ebay and another at apple.

As a developer I know the importance of salting and hashing passwords. Assuming these high profile tech companies follow good practices there should be no way (without a few hundred years of time on a supercomputer at least) that anyone who has stolen users' details can calculate the original passwords.

The much bigger risk is the personal information such as names/addresses/security questions and answers.

Why do companies and news agencies frequently advise users to change their passwords?

share|improve this question

closed as too broad by m4573r, random May 29 '14 at 18:03

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

You assume all follow good practices such as salted+hashed password storage & that users don't reuse passwords. – Sathya May 29 '14 at 9:52

Security is about minimizing risk. By telling you to change your password after an attack, they are ensuring they've done their due diligence in re-securing the system. This way you can't come back and sue them for data loss after the breach, as they told you to change your password. For example, in the Target data breach recently, there were several banks that sued Target for not doing due diligence and not securing the system properly, causing fraudulent charges when they did get hacked.(1)

Included in minimizing risk is realizing that there is always some new way of getting at data, like using cloud infrastructure like Amazon to run brute-force attacks(2). If someone has the data, they will eventually figure it out, and good practice is to assume that it has been breached.

As an analogy, let's say the owner of a multi-unit building had his key-box stolen, but none of the keys were labeled. No tenant would question having the locks of the units changed, even though it would take a long time for someone to break into a unit by trying all the keys. The building owner would be held responsible if anything was stolen from the apartments until they were changed.




share|improve this answer

Because there are different kinds of vulnerabilities. Some vulnerabilities allow attacker who has stolen password hashes to access protected user's data/service/... by just providing a hash, rather than actual password.

This means that even without brute-forcing the hash for days weeks and months, attacker can find a way to feed the hash directly to the system and let himself in. If a vulnerability that potentially allows such scenario is found, then advising users to change their passwords is an essential step. Changing the password will make all stolen hashes invalid.

This does not happen too often though. I would argue about the word always in your question. I have often seen message from companies stating that vulnerability has been removed and there is no need to change the password.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.