The Downside to Mandatory Password Changes

Logethica

Level 13
Thread author
Verified
Top Poster
Well-known
Jun 24, 2016
636
Column: The Downside to Mandatory Password Changes:

Is requiring users to regularly change their passwords a good idea?
Passwords are often referred to as the weakest link in security by many cybersecurity professionals, primarily because of the human element...

Digital-Life-Password-Tips-1757x1254.jpeg


Human behavior is very predictable by sophisticated hackers and when left to their own abilities, the average user will create weak passwords that are easy to break because it’s just not an intuitive process.

With this in mind, many researchers are suggesting that forcing users to regularly change their passwords, which is common in corporate settings, can actually encourage the creation of weaker passwords.

Several researchers have published studies over the years warning of the unintended consequences of regularly forced password changes and one of the more prominent figures to speak out on this common practice is the chief technologist for the Federal Trade Commission, Lorrie Cranor.

Her FTC blog post “Time to rethink mandatory password changes” points to a university research paper that showed users tend to use predictable patterns they call “transformations” (like just adding the next number) when regularly required to change passwords...

To read the full article please visit the link at the top of the page

 

Logethica

Level 13
Thread author
Verified
Top Poster
Well-known
Jun 24, 2016
636
Are PassPhrases better than Passwords?
SOURCE: adn.com (ARTICLE DATE: 11th Aug 2016)

Passwords that once looked like this: "W@5hPo5t!," can now be this: "mycatlikesreadinggarfieldinthewashingtonpost."

Requiring longer passwords, known as passphrases, usually 16 to 64 characters long, is increasingly seen as a potential escape route from our painful push toward logins that only a cryptographer could love.

A series of studies from Carnegie Mellon University confirmed that passphrases are just as good at online security because hacking programs are thrown off by length nearly as easily as randomness. To a computer, poetry or simple sentences can be just as hard to crack. Even better: People are less likely to forget them...

To read the full article please visit the link at the top of this post
 

DardiM

Level 26
Verified
Honorary Member
Top Poster
Malware Hunter
Well-known
May 14, 2016
1,597
Thank for the article :)
I voted :
  1. I Use a Password Manager (local)

  2. My Passwords always include Upper & Lower Case /Numbers/ Special Characters

  3. I use a Random Password Generator That Creates Very Long/Complex Passwords

Some upper-case , lower-case, numbers and special chars in a Passphrase => total with min 8 chars.

One good example could be :

"My8catslikereading@Garfield@inthewashingtonpost:)[2016]"
8 : month
2016: year
for someone who change pw every month :D

You can alternate, for example, E and e (paranoid mode ON)
"My8catslikEreading@GarfiEld@inthewashingtonpost:)[2016]"
 
Last edited:

DardiM

Level 26
Verified
Honorary Member
Top Poster
Malware Hunter
Well-known
May 14, 2016
1,597
How to add the smiley in the password;)
It was not my purpose, only : and ) , but when posting, the editor tool replaced it with an emoticon :(
Code:
"My8catslikereading@Garfield@inthewashingtonpost:)[2016]"
"My8catslikEreading@GarfiEld@inthewashingtonpost:)[2016]"

I found a temporary method to post it on MT forum ! :oops:

Or changing it with an emoticon that the Editor tool doesn't know :)

=> "My8catslikEreading@GarfiEld@inthewashingtonpost:'([2016]"
 
Last edited:

Exterminator

Community Manager
Verified
Staff Member
Well-known
Oct 23, 2012
12,527
I use a password manager for my personal business.
However my place of employment requires mandatory password changes quite often at varying intervals and it must be completely different from the current password.
Mandatory password changes are a good idea however most people just use the same password with a single change such as a capital letter.
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top