Can you hit a moving target?
Summary: PortSwigger's Dafydd Stuttard analyzed a six-digit password that regenerates every 60 seconds and calculated that an attacker making one guess per password would expect success after 693,147 attempts, versus 500,000 for a static six-digit password. He put the difference at 39% more attempts, which he said is not enough to justify the "unbreakable" claim or the cost of the password-generating device.
What's compelling: A rotating password that adds only 39% more guessing effort over a static one leaves the same core exposure, so a security leader buying a token on the strength of "it changes every 60 seconds" is paying for a modest delay, not a barrier.
Read the original at PortSwigger Research ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026