The Downside to Mandatory Password Changes

[Logethica]

Column: The Downside to Mandatory Password Changes:

Is requiring users to regularly change their passwords a good idea?
Passwords are often referred to as the weakest link in security by many cybersecurity professionals, primarily because of the human element...

Human behavior is very predictable by sophisticated hackers and when left to their own abilities, the average user will create weak passwords that are easy to break because it’s just not an intuitive process.

With this in mind, many researchers are suggesting that forcing users to regularly change their passwords, which is common in corporate settings, can actually encourage the creation of weaker passwords.

Several researchers have published studies over the years warning of the unintended consequences of regularly forced password changes and one of the more prominent figures to speak out on this common practice is the chief technologist for the Federal Trade Commission, Lorrie Cranor.

Her FTC blog post “Time to rethink mandatory password changes” points to a university research paper that showed users tend to use predictable patterns they call “transformations” (like just adding the next number) when regularly required to change passwords...

To read the full article please visit the link at the top of the page

 

[DJ Panda]

I change my main password every 6 months and use a password manager with a randomized feature for added security.

 

[hjlbx]

Problem is - that no one yet has been unable to solve - is eventually you will lock yourself out of PCs and\or devices with frequent password changes or pay for premium softs - unless you keep everything interconnected - which is definitely bad ju-ju in itself.

 

[Logethica]

Are PassPhrases better than Passwords?
SOURCE: adn.com (ARTICLE DATE: 11th Aug 2016)

Passwords that once looked like this: "W@5hPo5t!," can now be this: "mycatlikesreadinggarfieldinthewashingtonpost."

Requiring longer passwords, known as passphrases, usually 16 to 64 characters long, is increasingly seen as a potential escape route from our painful push toward logins that only a cryptographer could love.

A series of studies from Carnegie Mellon University confirmed that passphrases are just as good at online security because hacking programs are thrown off by length nearly as easily as randomness. To a computer, poetry or simple sentences can be just as hard to crack. Even better: People are less likely to forget them...

To read the full article please visit the link at the top of this post

 

[DardiM]

Thank for the article
I voted :

1. I Use a Password Manager (local)
   
   
2. My Passwords always include Upper & Lower Case /Numbers/ Special Characters
   
   
3. I use a Random Password Generator That Creates Very Long/Complex Passwords

Some upper-case , lower-case, numbers and special chars in a Passphrase => total with min 8 chars.

One good example could be :

"My8catslikereading@Garfield@inthewashingtonpost[2016]"
8 : month
2016: year
for someone who change pw every month

You can alternate, for example, E and e (paranoid mode ON)
"My8catslikEreading@GarfiEld@inthewashingtonpost[2016]"

 

[Deleted member 2913]

Some upper-case , lower-case, numbers and special chars in a Passphrase => total with min 8 chars.

One good example could be :

"My8catslikereading@Garfield@inthewashingtonpost[2016]"
8 : month
2016: year
for someone who change pw every month

How to add the smiley in the password

 

[DardiM]

How to add the smiley in the password

It was not my purpose, only : and ) , but when posting, the editor tool replaced it with an emoticon

"My8catslikereading@Garfield@inthewashingtonpost:)[2016]"
"My8catslikEreading@GarfiEld@inthewashingtonpost:)[2016]"

I found a temporary method to post it on MT forum !

Or changing it with an emoticon that the Editor tool doesn't know

=> "My8catslikEreading@GarfiEld@inthewashingtonpost:'([2016]"

 

[Exterminator]

I use a password manager for my personal business.
However my place of employment requires mandatory password changes quite often at varying intervals and it must be completely different from the current password.
Mandatory password changes are a good idea however most people just use the same password with a single change such as a capital letter.