Slashdot Mirror
How Often Should You Change Your Password?
jhigh writes "Bruce Schneier asks the question, how often should you change your password? 'The primary reason to give an authentication credential — not just a password, but any authentication credential — an expiration date is to limit the amount of time a lost, stolen, or forged credential can be used by someone else. If a membership card expires after a year, then if someone steals that card he can at most get a year's worth of benefit out of it. After that, it's useless.' Another reason could be to limit the amount of time an attacker has to crack the password, but Bruce's analysis seems on target."
You can change your password as often as you like, but if you don't use a strong password then you're always going to be at risk of a brute force hack or be a victim of the 'over the shoulder' spy.
I just changed mine to 54321a
They'll never hack me now!!!!!!!!!!!!!!!!1111111111111111oneone
It depends on the user's preference, how secure the application is, and most importantly how secure the password is. A sufficiently strong password will have a minimum to how often it should be changed to protect from passwords being leaked (although this shouldn't be much of a problem either if passwords werent stored in plaintext or easy to decrypt ciphers).
If someone steals your password, as I learned when my gmail account was hacked, the first thing they're going to do if they know anything is change both your password and your security questions. The only way changing your password will help is if the person who's stolen it is too dumb to do this, and that seems unlikely.
All sounds pretty reasonable and pretty obvious. I wish someone would tell our security department. They force fourtnightly changes, with ten days warning of expitation. That means you either change more than once a week or have the expiration password pop up!
His argument is only valid for certain cases, where damage done can be spread out over the course of days or weeks. Sometimes the majority of damage/benefit derived can be derived within minutes or hours. Example: access to a victim's email account (to mine contact list or to spam or to impersonate) or access to a bank account, in which a sizable transfer can be done immediately.
About 99% of the time it would take to brute force it.
...lose the post-it note on the bottom of your keyboard that you wrote it on, of course.
He who knows best knows how little he knows. - Thomas Jefferson
Are you hiding something?
Space Cadet
If a membership card expires after a year, then if someone steals that card he can at most get a year's worth of benefit out of it. After that, it's useless."
Unless, you know, you log in and it prompts you to change the password. Now it's not only useful to the person who stole it, but useless to the person it actually belongs to.
I personally don't think password changes should be required unless there is a specific reason. Someone hacked your account? Change your password.
If you have passwords for a couple dozen systems (very easy) and each of them requires you to change your password every 3 months, you're going to start forgetting them. So you don't, you're going to start writing them down or storing them in some way. Or you're going to increment a number in your password, so it's still basically the same. Or you're going to use the same password for slashdot and faceboook.com (see that? it's a spoof site designed to steal passwords) and your bank account.
Whale
Another suggestion from the expert where millions of people will waste time, yet, nothing security wise will be improved.
Never use the same password in two places
Always use randomly generated password
Never same them to browser cookies
Never write them down so they can't be stolen
Is it just me or are security experts willingly trying to get us to just forget the twenty to thirty passwords we need to use on a weekly basis?
"Use it regularly, change it frequently, and don't share it with anyone!"
Encryption: I may not agree with what you say, but I will defend your right to encrypt it...
All the passwords do is serve as a minor stumbling block.
If people are brute-forcing your password, then you have other problems. If your password is exposed somehow, then you have other problems.
It's like having your house broken into. If they have a crowbar, then they're going to get in if there's nothing to stop them. If they get a wax mold of your key, or that spare key you leave under the doormat, they're going to get in.
How do you stop them? Security inside, perhaps? Neighbors who keep an eye out for you? Police who patrol the neighborhood?
The Door is just a way to deter the lazy and disinterested.
Same with passwords.
an expiration date is to limit the amount of time a lost, stolen, or forged credential can be used by someone else
=
to limit the amount of time an attacker has to crack the password
One of my old sysadmin books used to suggest resetting a password every time someone with access to the account leaves the job, after a major upgrade, whenever a security breach may have occurred or any day when you're not too drunk/hungover to forget the new password.
It most likely too often! Seriously, I don't understand IT policies with changing your password every 30, 60, etc. days. All it does is force me to come up with very simplistic passwords. I think it's better to come up with a strong password and keep it than to continually change it. As it is, I have at least 20 or more active passwords; to create 20 different passwords every n days is crazy. I don't like using the same password with different systems as the password can be exposed to the system owner which can be used to gain access to another system. Needless to say, my work passwords are the worst ever... Will someone in IT get a clue. We should be using public/private keys instead of passwords!
Passwords are so 1990. I realize that it requires a little extra work, but those RSA-type key fobs that have the little LCD that displays a new "passcode" every minute should be universal by now... I love those things.
Banks should issue them to everyone, employers should issue them to everyone...
C'mon this technology has been in active use for at least 15 years now...it should be cheap and everyone should use it.
Karma: Excellent. 15 moderator points expire sometime.
Make people pick a strong password and then let them keep it. I mean, if it never exists outside somebody's head, it can't get lost or stolen. Forcing regular changes makes them likely to forget, or run out of ideas and choose weaker passwords. For example, I know someone who copes with the requirement to change regularly by cycling through the names and numbers of the players of his football team. This is fairly easily guessed at, and he wouldn't have to do it if he didn't have to keep changing his password.
Obviously I've no numbers to back it up, but I'd imagine security is breached far more often by finding passwords scribbled on Post-Its than by brute-forcing. I mean, that's really hard to do, and the rewards have to be well worth the effort, which they seldom are. So eliminate the need to write them down which so many people obviously feel.
Nobody knows my passwords but me. I've never written them down. I've never suffered any security compromises.
If this is news, then things are really slowing down in the security industry.
We've been going through this at work. The "security experts" came up with all kinds of assanine rules. Stuff like "don't show the length of the password as a user types", "don't reuse the same password on different systems", "don't write them down", "change them every 3 weeks", etc.
The problem is that none of these people have a bloody clue how ordinary users deal with this stuff. If you listen to security experts, you get bullshit that destroys usability and forces users to get ever more creative in bypassing the rules.
IMO no "security expert" should be allowed to come up with rules without a usability expert sitting behind them holding a taser.
-- "So they told me that using the download page to download something was not something they anticipated." - Bill Gates
Frankly, the answer is almost always "Never"
The human brain is not good at memorizing strings. I deal with well over 100 passwords a normal week. Assuming, generously, a 6 month timeout it would mean memorizing new passwords every few days. I have better things to do with my life. Much better things. As does the vast majority of users, which is why any company with short password timeout find that the passwords are either on post-it notes under the keyboards or a variation of "anna-December01".
If your system demands high security a passwords are not suitable anyway. You should be going for multi-factor authentication, not make the passwords longer or time out more often.
But, you might say, shouldn't changing passwords limit my exposure in an networked environment?
Well, there are a few alternatives. If you store your passwords in an insecure manner (postit under the keyboard, your secretary etc...) then you have allready lost. Anybody can grab your password when they need it. If you keep them secure (memorized), but worry about some server being hacked there are two allternatives: Either you have the same password everywhere, and then updating the password won't change anything, as the attacker will have your password the moment you update it. Or you have different passwords, and then it server where you updated it will still be compromized, but the rest still secure.
If you send your passwords in clear text over the network and worry about sniffing you don't care about the security.
In the end, passwords are simple security mechanisms for discuraging causual abuse of systems. Make sure they do not fall to a trivial brute-force attack and move on. If you need real security you will have to look beyond passwords anyway.
If you use Keepass or some other sort of ultra-encrypted password safe, you only need to remember one. Besides, you'd be surprised how well your fingers remember $A45j00)&er]{ after a while, even if your brain doesn't. That may be a signal it's time to change your password, however...
Which of the couple dozen passwords I have for various places do you suggest I change frequently? All of them? I've never had my accounts cracked yet, and for any of them except banking (who use more than just a password) I don't care if they do. On the other hand, I've lost count of the times that I had to waste half an hour because I had forgotten the new password because some moronic policy forced me to change it.
How about just changing the password when you have a reason to.
My RSA token generates a new unique password every 60 seconds.
Passwords should have lifetimes dictated by their strength.. Weak passwds rejected, mild passwds say 30 days, medium passwds 60-90 days, strong passwds 180-360 days, and impenetrable passwds should not require changing.
Impenetrable = >= 16 characters, mixed case, numerals, punctuation, and passing all dictionaries. I have 3-5 of these consigned to muscle memory, and rotate thru them whenever I'm forced to change my passwd, it's annoying as FUCK.
Passwords as currently known will hopefully become old hat soon. I long for the time when I can own a private key in hardware, where drivers on all platforms are cheap commodity and where all programs and systems will be able to offer e decent authentication interface.
A password can be stolen more easily than the combination password + private key.
I hadn't the slightest objection to his spending his time planning massacres for the bourgeoisie... (P.G. Wodehouse)
Just sayin'
if you are confident your password will not be on a wordlist, and you know the encryption technique. every "less than the time take to bruteforce the password should the has be obtained", however frequently that is. If your password is "aaaa" youll be changing it every 10 seconds
http://snappeh.com/blog/ - My Blog, not that any of you care...
Seriously I've used "1234" on all my email accounts and my root admin account for years and never had the problem. ;?>I ALW7H;
Hold a sec. My router is going a little crazyF8($&#Rin85M3$%
s fpjl
[CARRIER LOST]
Well, there's spam egg sausage and spam, that's not got much spam in it.
This again. Just like that lady from Microsoft which challenged the 7 password rules.
I am not a security specialist. Yet I seem to know something they don't: that "frequently" changing the password is meant to avoid brute-force over the password hash being profitable, not to avoid a person who already knows the password to use it.
Example: excluding the dictionary-based, < 8 length, all lower case letters, etc which are broken easily, let's suppose it takes 2 months to break a good password's hash by brute-force.
If your system obliges you to change your password every 2 months - 1 day, when the attacker finally breaks the old password it's no longer valid. The bonus would be to catch the attacker when he tried to use it.
That's the theory. If it works or is worth the trouble, I don't know. But I'd love to see that being discussed by the so-called specialists instead of unrelated use-cases.
http://dilbert.com/2010-12-13
I give my clients a simple process to create 'strong' passwords out of normal words or phrases (preferably 10+ chars) that makes them easy to remember.
Yeah, and if your clients only have one password to ever remember, and didn't have to change it, that would solve the problem. I have fifty passwords, many of which have to be changed every three months. Do you give your clients a "simple process" to create two hundred passwords per year, and remember which one goes with which system?
By the way, the single most important thing you should do to make sure your clients are secure is to make sure that they don't use the same password to access different systems. If they re-use their password on an insecure phishing site, doesn't matter how "strong" it is with "10+ chars"; it might as well be 123456.
http://www.geoffreylandis.com
Speaking of which, I'm surprised nobody has posted the link to the relevant xkcd yet.
http://xkcd.com/792/
http://www.geoffreylandis.com
If you are at all worried about changing your password, then a password is not enough. Changing doesn't help, as soon as your password is compromised it needs to be changed. Multiple factors is a much better solution than changing passwords, which only provides a false sense of security at best.
Related questions: how often should you change your username? real name? identity? SSN? fingerprints? retina pattern? DNA?
Oh, say does that Star-Spangled Banner entwine / The myrtle of Venus with Bacchus's vine?
It encourages password reuse. If you have to learn a new password all the time, well then makes sense to keep it to just one password. Every month you learn a new password and change it on all your sites. That's really secure! ... Not. That situation means if someone gets your password, they are in to EVERYTHING.
Personally I'm with Schnier that password changes aren't useful on their own and I take it further: You shouldn't change your password unless there's a reason for high security systems because your password should be hard. It should be something reasonably lengthy and reasonably difficult that is used ONLY for that system/service. Random characters is good, a book quote with modified letters is good, etc. Something that takes you a bit to get memorized. Reason is not only is it hard to crack, but it is hard for people to pick up if you type in. They can't just look over your shoulder and get the password, they'll be unable to remember it.
That makes it unlikely you'll be cracked, and that in the event something else is compromised, means that the damage doesn't spread. THAT is secure, that is what you want. Problem is those kinds of passwords can't be changed all the time because they are hard to remember. Make people change them every month and they'll not only start writing them down, but reusing them among systems.
I want to ask all the "security" people that think short password change policies are a great idea "Do you change the locks on your house every couple months? Then why should passwords be changed so often?"
Continual password changes are security theater, not security, and actually tend to make things worse.
A = average number of people targeting you via password attacks at any time.
B = average time it takes for your password to be hacked by one person.
T_expire B/A
So you can improve security by
1. Heeding T_expire
2. Increasing B by using trickier passwords
3. Reducing A by nuking China
Every password that you use that can be different, SHOULD BE DIFFERENT. This is a risk mitigation method.
Many professionals use a password manager like LastPass or KeePass or KeePassX and honestly only know the 30+ character passphrase to open that DB.
I have hundreds of accounts and each has a different password. I use 30+ character randomly created passwords for each and have only 2 out of all these memorized - the main domain login to my main desktop AND the passphrase into KeePassX. All the other passwords ... I have no idea what they are and don't care. That's what a password manager is for.
I worked in a government lab and had to physically stand in front of the network administrator once a year to retain network access. If I didn't show up, I was cutoff. Remote users actually had to fly into our location to proved they still deserved access.
How often should a password be changed? Anytime there is a risk that it has been compromised. A stronger and longer password can help reduce the risk. At my company, we force password changes every 56 days - why 56 days? 56 is divisible by 7, so Tuesday is the day that I change my passwords. That gives me 3 days to learn it before a weekend.
Each organization will need to determine how often that could happen. For some organizations, it could be weekly, for others, yearly.
In theory, forced password changes leads to more security, as it narrows a window of compromise.
In practice, a force password change often leads to less security. The basic problem is that it's hard to memorize passwords.
If forced passwords are too frequent, people will change 'mypassword' to 'mypassword2', then 'mypassword3'.
Or change to a new more secure string unrelated to the previous one. Perhaps 'Xoolu3j3e'. However, in the case of too frequent changes here, its hard to keep track of the passwords, so perhaps they get written on a sticky, or saved in the browser. Possibly a keychain on your computer helps, though then what do you do with a lost pc? write them down? assume that you can reset by some email verification ?
I wonder how often forced password changes really leads to better security.
Are we really discussing this nonsense again? I have easily 15-20 passwords for various things and I am not even on Facebook and the like. I don't have a /. account cause I will not remember another password and the site allows me to post anonymously. I am not hiding from anything other than another password. I no longer shop online where I have to have an account for the same reason. If you think that normal people will remember even 10 unique long passwords you are out of your mind. If you think that it cannot be the same for the last x times, guess what people do? They spend the next 4 hours entering in enough password to get back to the last one they used and remembered.
Passwords are a weak attempt at security. Suggesting anything else is insane. It has to be easy to be effective and words as passwords are not easy and will never ever be effective.
"Of course my password is the same as my pet's name.
My dog's name was Q47pY!3$H9x, but I change it every 90 days."
I have in excess of 10 passwords just for work (and I'm not an admin, just an end-user, here).
Every one of those pieces of software has different rules and timeouts. Some have aging enabled, some don't. Some prohibit reuse, some don't.
I keep a spreadsheet with the rules for all of them (not the actual passwords; those I memorize), and change them en masse when the shortest-lived one nags me.
So the question is moot. It's not reasonable to believe that in our lifetimes we'll get all of the makers of various pieces of software to change the way they control passwords. Many of these software packages have designs that are ingrained in contracts. Not that the details of the password system are called-out in a contract, but changing anything about the software is a matter of reopening requirements specifications that were locked-down according to a process that is defined and referenced in a Software Development Plan that is released and signed and referenced in a contract. Times the thousand instances of the software at the software vendors' various customer sites. And it's not possible to make a companywide decision to turn off password aging or protection on some of the software, as it's built-in turned-on by the vendor to protect their licenses.
So the answer is, I need to change my passwords as often as the software insists. Not that I want to, or that it makes any sense, but that it's how it is, and I can change that no more than I can change the commute routes available to me.
A membership card expires after a year because that's all the time you've purchased a membership for, not as a security measure.
Security experts will tell you that usability is a part of security. The harder it is to use a system, the more likely it is that people will make a mistake, and in the case of a security system that often means compromising security in some way.
Passwords as a secure authentication method are a really bad idea. Humans are pretty terrible at coming up with random passwords, and only marginally better at remembering a randomly generated string. It is easy to accidentally enter the one system's password when logging into another system (and if you are logging into a system run by someone like Mark Zuckerberg, this could get you in a lot of trouble). Cryptographic logins are a hell of a lot better, all that would be needed is a good way for people to carry crypto keys around with them (which is not asking much given how many different storage devices people usually carry around -- cell phones, thumb drives, cards, etc. -- any one of which could be used to store a key). Web browsers are already capable of supporting cryptographic logins, it should not take a terrible effort to enable web browsers to use crypto keys stored on some portable device.
Yes, I know, someone could steal your thumb drive and get all your credentials. Yet we rely on house keys to protect our homes, and someone could steal your house keys and enter your house (which would give them physical access to your computer). Users can use a passphrase to help protect their crypto keys from theft (this is somewhat better than just a password login since an attacker would need the keys before they could even attempt a brute force attack, and your passphrase would only need to thwart an adversary long enough for you to report the theft and revoke the stolen keys).
Palm trees and 8
NUML=Length of password
NUMC=Number of non-sequential capital case letters in password
NUML=Number of non-sequential lower case letters in password
NUMN=Number of non-sequential numbers in password
NUMS=Number of non-sequential symbols in password
NUMW=Number of dictionary, name, or common words in password
( ( (NUMC*.75) + (NUML*.75) + (NUMN*.5) + (NUMS*2) - (NUMW) ) / NUML) *.1 *30
Yields maximum number of days to use a password, take lowest value of either this result or 120 days... if you come up negative, you screwed up, try a real password.
Whew. When I got the recommendation from the guy who wrote the book on security, I wasn't so sure. But since jhigh endorses it, I'll take it under advisement.
What if people just increment their passwords? Every few years (or password expires) I just increase the number at the end. Mine is now TrustNobody2009. It expires the older password and still keeps it easy to remember
If you mandate that people change their passwords often, they will use weak passwords or write them down. The shorter the cycle, the more likely this happens.
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
"Perfect timing...bout 99% of the time it would take to brute force it."
Exactly so. The point of changing passwords is NOT to keep people from having access for too long -- that would be stupid beyond belief. The point is to change the password REGULARLY, based on the password complexity, and how long it would take to brute-force a password of that complexity.
Isn't that the whole point of a password? Instead of each user having to identify themselves by an arbitrary means on each login, the password provides a standardization of login protocol.
In the beginning, there was null.
At least things have improved from what they were like in Win2k days...
"There once was a man from Nantucket..."
The answer is, of course, dependent the maximum time for which you can stonewall your Pointy Haired Boss before he orders you to tell him the root password or else.
That's about how often.
In a survey of 100 programmers, 111111 thought that duck-typing was a good idea.
... the proposed password life time to the time required to crack it. For dictionary attacks, the crack time might be a matter of hours (depending on login policies which detect failed attempts). Keylogging attacks can compromise a password in seconds.
So a system with poor security settings, no malware detection, etc. is pretty hopeless. Likewise, a user who doesn't pay attention to the "last login attempt 5 minutes ago from somewhere in Russia" message is screwed (unless they are actually in Russia).
Have gnu, will travel.
dude, you use a dial-up modem? passwords are the least of your concerns.
Now if only I had Rich Little's talent.
How often should you change your password?
That depends on if you're trying to deny them access to their account, or trying to spy on what they're doing... oh, wait you mean the passwords I created, not the ones I've cracked... Pfft, screw "my" passwords, I'll just use yours instead.
Don't judge me! Excuse me while I send a text to my friends via smoke signal.
Well, there's spam egg sausage and spam, that's not got much spam in it.
Have anyone every tried to use L33T as a way to create new passwords? You take words, add L33T to them and they become an amalgamation of letters, numbers and punctuations. It's easy to remember since they are words, and L33T is a relaxed enough system so everyone's L33T is not uniform. It's like a poor man's encryption system!
This is probably a bigger issue with all of the online services these days:
http://xkcd.com/792/
They could photograph your house keys and create a duplicate key from the photo.
For systems, I've never found a need for more than the following:
Root login only via console; no SSH.
Key-based authentication for user SSH logins
A decent password for sudo privileges.
Banking? Oh, please. There's enough nonsense with my banks - numeric IDs, PINs, security phrases, little pictures to select, abnormal IP checking. All of which could be easily bypassed by a five minute conversation after an hour on hold.
The rest? Because I really care if you h4x my Facebook account.
There are downsides to changing your passwords frequently, which should at least be considered along with the upsides. Specifically:
All that being said... yeah, passwords do have a shelf-life. I'd just warn against going overboard on frequency. Using password keychains mitigates a lot of that, but ties you to the keyring. Like so many issues in security, there's no perfect answer.
Everybody gets what the majority deserves.