49% of workers, forced to change passwords, reuse same one with minor change
1–10 of 316 posts
Re: 49% of workers, forced to change passwords, reuse same one with minor change
#2Not trying to set myself to be a target of hacking with this comment, but what's wrong with that? Why does a password that wasn't hacked need to be changed a lot? If someone is going to try to break into my account my password being similar to one I used 6 months ago increases my vulnerability how?
Re: 49% of workers, forced to change passwords, reuse same one with minor change
#3Only 49%? That's way lower than I would have expected, I wonder if there were people in the survey that weren't willing to admit it?
Re: 49% of workers, forced to change passwords, reuse same one with minor change
#450% write their passwords down in a notebook or sticky note near their computer[1]
1% use a password manager[1]
[1]%100 of these stats are assumed
Re: 49% of workers, forced to change passwords, reuse same one with minor change
#5Not trying to set myself to be a target of hacking with this comment, but what's wrong with that? Why does a password that wasn't hacked need to be changed a lot? If someone is going to try to break into my account my password being similar to one I used 6 months ago increases my vulnerability how?
It vastly reduces the key space for a brute force attack, e.g. if an attacker has access to old passwords, they can brute force ~50% of them by iterating through A-z0-9 fairly quickly.
Re: 49% of workers, forced to change passwords, reuse same one with minor change
#6Not trying to set myself to be a target of hacking with this comment, but what's wrong with that? Why does a password that wasn't hacked need to be changed a lot? If someone is going to try to break into my account my password being similar to one I used 6 months ago increases my vulnerability how?
The point of changing your password is to prevent a password leak from affecting your system. If an unauthorized user has a password they have access until it's changed.
If the change isn't meaningful they can continue using credentials.
Re: 49% of workers, forced to change passwords, reuse same one with minor change
#7This should not be a surprise, as this supports the NIST's revised recommendations (from June 2017!) that passwords should not expire [0], because it actually leads to less-secure passwords for this exact reason.
Furthermore, many corporate systems do not integrate well with password managers, such as when first logging in to your system in the morning. This means that the password is likely to be one of the few that must actually be memorized. If you ask me to memorize a 32-character random string, I will, but I won't memorize a different 32-character string every 6 months!
Re: 49% of workers, forced to change passwords, reuse same one with minor change
#8Companies should provide a password manager solution for their employees, if they care.
They make us change it every 30-90 days, tell us not to write it down anywhere, and don't want us to just add '1' on the end, but expect us to memorize it. I'm not going to pony up my own money for a password manager to use at work and try to make it work there. I pay for one for my own use and it stays for personal use.
Re: 49% of workers, forced to change passwords, reuse same one with minor change
#9The company I work for requires a password change every 60 days and a history of 9 passwords. Every other password I have in my 1Password so its ultra strong and secure (I use a 5 word passphrase). For my login password I just change the last digit in a loop between 0 and 9.
Re: 49% of workers, forced to change passwords, reuse same one with minor change
#1050% write their passwords down in a notebook or sticky note near their computer[1] 1% use a password manager[1] [1]%100 of these stats are assumed
Notebook is a password manager