WHEN IT COMES to password security, you’re sometimes told to change your password regularly so your account is safe from anyone who tries to access it.
The logic is as follows. If you’re changing it regularly, then it’s harder to guess what your password is and therefore harder to access your account.
It turns out it’s a flawed idea according to one security expert, the US Federal Trade Commission’s chief technologist Lorrie Cranor, who confirmed it at a security conference in Las Vegas recently.
The problem with this advice is it assumes you’ll change your password completely. Most people won’t go to that effort. Instead, they’ll just change a character in their old password.
They might replace a small character with a capital letter, or just add an extra letter or number to the end. Instead of a new password, they are using a slightly modified version of an old password.
“The UNC (University of North Carolina) researchers said if people have to change their passwords every 90 days, they tend to use a pattern and they do what we call a transformation,” Cranor said at the event. “They take their old passwords, they change it in some small way and they come up with a new password.”
The research she’s referring to a UNC study from 2010 which looked at 10,000 expired accounts from employees or students who were required to change their passwords every three months (they obtained the cryptographic hashes which protect these accounts).
The data included the last password used and passwords that changed over time. One of the most common patterns they found was how how often people would just change or add a character to their existing password.
These slight changes are what hackers and other bad actors rely on as they’re easy to guess. Developing a program which automatically guesses the most common passwords is usually one way for someone to gain access to accounts.
That’s not to say you shouldn’t change your password ever, but the aim is to make it long and random. Also, if you’re reusing the same one for different sites – which is a terrible idea – you should change that immediately. Using a password manager to help remember complex passwords is one of the best ways of solving this.
To embed this post, copy the code below on your site
have your say