How often do you change passwords?
- Thread starter bigred
- Start date
Skeptical Greg
Agave Wine Connoisseur
Every time my bank account gets emptied.
Blue Mountain
Resident Skeptical Hobbit
Only when a clueless provider forces me to, either due to outdated standards or because they were breached. I was using a home-grown encrypted password manager before they became a thing. I've always used strong passwords and never, ever used a password on more than one site. The idea that passwords should be changed regularly is a myth: NIST acknowledged back in 2017 that regular changes do not improve security, and formally removed that requirement last year.
rjh01
Gentleman of leisure
I think they removed the requirement to change passwords many years ago.
Everyone needs some sort of password manager. However passwords need to be removed. Using an email would be better. Until your email system gets hacked.
Everyone needs some sort of password manager. However passwords need to be removed. Using an email would be better. Until your email system gets hacked.
alfaniner
Penultimate Amazing
I once had a provider, not that long ago, send me an unencrypted verification email with "Your Login:xxxxxxx Your New Password:yyyyyy". Note: it wasn't a temporary password -- it was the one I had just created and changed it to on the site itself.
rjh01
Gentleman of leisure
The only thing that should know your password is you or your password manager. It should not be stored by the other end. They should put the password though a complex one way encryption formula and store the result.
rjh01
Gentleman of leisure
It does not say when the quoted paragraphs were inserted into the guidelines.
Edit. https://web.archive.org/web/2022121....nist.gov/800-63-4/sp800-63b.html#passwordver This is from 18 December 2022
Last edited:
plague311
Great minds think...
I never change my passwords unless I'm given a reason to and that isn't very often. There is a website that'll tell you about your email being in hacks though. It's haveibeenpwned or something similar. I used to check but I use 2 form authentication on everything that matters. Having my password is pretty useless nowadays. I can't think of anything worth while that someone could access without either having my phone, google auth, authy, or microsoft authenticator codes.
novaphile
Quester of Doglets
I still get some funny looks when I type in a PIN.
Everyone assumes a four digit PIN, because that's the least number of digits you can have.
Whereas I use the maximum number of digits. (Which varies by card, or application.)
So a vendor hears a long string of beeps and thinks: "That's not gonna work."
And then it does.
Everyone assumes a four digit PIN, because that's the least number of digits you can have.
Whereas I use the maximum number of digits. (Which varies by card, or application.)
So a vendor hears a long string of beeps and thinks: "That's not gonna work."
And then it does.
gabeygoat
Master Poster
I3QQa&1365_w77
novaphile
Quester of Doglets
Damn! That's the combination on my luggage!
novaphile
Quester of Doglets
I used to log into one system, that was so nasty, you had to include at least two characters that weren't on the keyboard.
(i.e. you'd have to 'compose' them by using key combinations, or the Alt + (hex number) method.)
(i.e. you'd have to 'compose' them by using key combinations, or the Alt + (hex number) method.)
rjh01
Gentleman of leisure
The best password rules should say the password must be long and not certain combinations of letters. Any other rule will weaken the passwords.
Here is a maths question for you all. If I use a password that is a random 10 characters using any valid character on the keyboard, how much longer must your password be if you only want to use lower case letters (a-z) and it to be even stronger than mine? The answer is not many.
Blacklists for small sections of obvious passwords are still best practice, and indeed mandated in the NIST documentation I linked to.
But.
Excessively large blocklists are of little incremental security benefit because the blocklist is used to defend against online attacks, which are already limited by the throttling requirements described in Sec. 3.2.2.
Dread Pirate Roberts
Critical Thinker
We've tried showing this to the Nevada Gaming Control Board since NIST put it in, but no go. We enforce 16 character minimum passwords, but everyone has to change every 60 days because of the GCB mandates it.
TragicMonkey
Poisoned Waffles
My workplace requires us to change passwords every 90 days. That wouldn't be a problem in itself, but unfortunately the various applications and systems that are supposed to sync up with password changes...don't. Sometimes I go weeks with two passwords and having to try both with everything.
Likewise, but at least I can force password changes to keep mine aligned
Similar threads
- Poll
