Frequent password changes may actually mean less IT security

Regular workplace updates can lead to users choosing weak passwords, experts say

Most office drones have had to deal with a job that requires them to keep changing their passwords like clockwork, maybe every six months or so.

The long-standing IT security practice is based on the idea that flushing out old passwords will cut off access for bad guys who may have figured them out.

But according to the U.S. Federal Trade Commission’s chief technolo- gist, Lorrie Cranor, the strategy has some major holes. “Unless there is reason to believe a password has been compromised or shared, requiring regular password changes may actually do more harm than good in some cases,” Cranor wrote in a blog post titled “Time to rethink mandatory password changes.”

That’s because forcing people to keep changing their passwords can result in workers coming up with, well, bad passwords.

That point is supported by research Cranor conducted at Carnegie Mellon University. It found that users who felt the institution’s password policy was annoying came up with passwords that were 46 per cent more likely to be guessed than those who supported frequent password changes.

Other research suggests that such password changes may not actually help keep bad guys out for long.

A 2009 publication from the National Institute of Standards and Technology explained it’s also “a source of frustration to users.”

And because those users are “are often required to create and remember new passwords every few months for dozens of accounts,” they “tend to choose weak passwords and use the same few passwords for many accounts,” according to NIST.

In a 2010 study cited by Cranor, researchers at the University of North Carolina at Chapel Hill looked at a data set of thousands of old passwords belonging to former students, faculty and staff at the university who had to change their password every three months.

They found that users often followed patterns that linked old passwords to new passwords — replacing a letter with a common number or symbol substitute (think changing an E into a 3), or adding or removing special characters like exclamation marks.

Using a tool they designed to predict those type of changes, the re- searchers could predict how users would change their passwords for 41 per cent of the accounts in less than three seconds using a relatively low-powered computer.

None of this means changing passwords is always a bad idea. Cranor notes a number of reasons why mixing it up could be a good thing — if you think your password has been stolen, if you’re reusing passwords across different services or even if your password is just plain weak.

But despite the conventional wisdom, it’s not clear that forcing users to change passwords on a regular basis actually makes sense for all workplaces.