Why changing your password regularly may really do more harm than good

MOST office drones have had to deal with a job that requires them to keep changing their passwords like clockwork, maybe every six months or so. The longstanding IT security practice is based on the idea that flushing out old passwords will cut off access for bad guys who may have figured them out.

But according to the Federal Trade Commission’s chief technologist, Lorrie Cranor, the strategy has some major holes.

“Unless there is reason to believe a password has been compromised or shared, requiring regular password changes may actually do more harm than good in some cases,” Cranor wrote in a blog post entitled “Time to rethink mandatory password changes.”

That’s because forcing people to keep changing their passwords can result in workers coming up with, well, bad passwords.

That point is supported by research Cranor conducted at Carnegie Mellon University. It found that users who felt the institution’s password policy was annoying came up with passwords that were 46 per cent more likely to be guessed than those who supported frequent password changes.

Other research suggests that such password changes may not actually help keep bad guys out for long.

Although password expiration can help reduce the fallout “of some password compromises,”a 2009 publication from the National Institute of Standards and Technology explained, it’s also “a source of frustration to users.”

In a 2010 study cited by Cranor, researchers at the University of North Carolina at Chapel Hill looked at a data set of thousands of old passwords belonging to former students, faculty and staff at the university who had to change their password every three months.

They found that users often followed patterns that linked old passwords to new passwords — such as swapping the order of meaningful numbers and letters, replacing a letter with a common number or symbol substitute (think changing an E into a 3), or adding or removing special characters like exclamation marks.

Another 2013 study, by researchers at Carleton University, also noted that in some cases, an attacker installed software that spies on users as they type.

So changing a password in this scenario has no benefit. The attacker will just be able to scoop up the new password the next time they log in.

For giant corporations trying to prevent data theft, changing passwords may slow down the hackers, but not prevent breaches. The abilities of spyware have reached scary levels.

A better idea may be for employers to explore log-in options that go beyond basic passwords — such as biometrics or two-factor methods that require users to also prove who they are by plugging unique codes sent via text for each log-in.

“In the longer term, we believe our study supports the conclusion that simple password-based authentication should be abandoned outright,” the UNC researchers wrote. — Washington Post