Cyber-security folks always advise us to use different passwords for all accounts and to regularly change them.
Intuitively, that makes sense.
And, many organizations now force employees, as a matter of policy, to change their passwords every couple of months.
But, a recent study by the FTC’s chief technologist, suggests that the security benefits of changing passwords may be more apparent than real … and, may do more harm than good.
According to the Washington Post …
“The longstanding IT security practice is based on the idea that flushing out old passwords will cut off access for bad guys who may have figured them out.”
But according to the Federal Trade Commission’s chief technologist, Lorrie Cranor, the strategy has some major holes.
“Unless there is reason to believe a password has been compromised or shared, requiring regular password changes may actually do more harm than good in some cases.”
“Because forcing people to keep changing their passwords can result in workers coming up with, well, bad passwords.”
Some evidence …
A study at the University of North Carolina looked at a data set of thousands of old passwords belonging to former students, faculty and staff at the university who had to change their password every three months.
They found that users often followed patterns that linked old passwords to new passwords — such as swapping the order of meaningful numbers and letters, replacing a letter with a common number or symbol substitute (think changing an E into a 3), or adding or removing special characters like exclamation marks.
Using a tool they designed to predict those type of changes, the researchers could predict how users would change their passwords for 41 percent of the accounts in less than three seconds using a relatively low-powered computer.
The researchers also determined passwords for 17 percent of the accounts in fewer than five guesses.
The problem isn’t periodic password changes … it’s benign neglect or passive aggressive behavior by folks who are annoyed by policies that attempt to save them from themselves.
Passwords should be strong … and they should be changed periodically … and, they should be varied across accounts. Period.
Heck no … but improves the odds.
And, whenever possible, use a 2-step process (e.g. challenge questions) for your most sensitive accounts.
Trust me, it’s less hassle than getting hacked.