There’s no need to change passwords if they're robust, unique and not breached
1–10 of 288 posts
Re: There’s no need to change passwords if they're robust, unique and not breached
#2Do people even actually change their passwords when there is no need to do so, just because the password is old?
Re: There’s no need to change passwords if they're robust, unique and not breached
#3Do people even actually change their passwords when there is no need to do so, just because the password is old?
I update my passwords from time to time. I don't trust the organizations will always say if there is breach, know there is a breach, or actually know how far and wide a breach went.
Re: There’s no need to change passwords if they're robust, unique and not breached
#4Do people even actually change their passwords when there is no need to do so, just because the password is old?
Yes. For sites, desktops, everything that have some rule stating that passwords expires after 30/90/180 days, must not repeat the last 3/5/10 passwords, must have at minimum/maximum n characters, must/must not contain special symbols or some subset of it.
Re: There’s no need to change passwords if they're robust, unique and not breached
#5Do people even actually change their passwords when there is no need to do so, just because the password is old?
3 of the last 4 places I've worked had as policy that you must change your password every 6 month.
Re: There’s no need to change passwords if they're robust, unique and not breached
#6Do people even actually change their passwords when there is no need to do so, just because the password is old?
This has been a standard IT policy for companies in the US for like 20 years. Probably 3/4 of the companies I've worked at over that time anyway.
Re: There’s no need to change passwords if they're robust, unique and not breached
#7Perhaps surprisingly, US government guidelines exist, are pretty fantastic, and agree with the author:
Memorized secrets SHALL be at least 8 characters in length if chosen by the subscriber. Memorized secrets chosen randomly by the CSP or verifier SHALL be at least 6 characters in length and MAY be entirely numeric. If the CSP or verifier disallows a chosen memorized secret based on its appearance on a blacklist of compromised values, the subscriber SHALL be required to choose a different memorized secret. No other complexity requirements for memorized secrets SHOULD be imposed.
Shameless plug - I'm the cofounder of Clerk and we handle passwords in a sane way out-of-the-box: https://clerk.dev/features/passwords
Re: There’s no need to change passwords if they're robust, unique and not breached
#8Do people even actually change their passwords when there is no need to do so, just because the password is old?
This has been a standard IT policy for companies in the US for like 20 years. Probably 3/4 of the companies I've worked at over that time anyway.
I think the question is do people naturally change old passwords without such policies.
The policies are the problem and the industry has recognized it so they’ve moved away from those recommendations.
Re: There’s no need to change passwords if they're robust, unique and not breached
#9Do people even actually change their passwords when there is no need to do so, just because the password is old?
3 of the last 4 places I've worked had as policy that you must change your password every 6 month.
My current work forces updates every 3 months. It seems more like a security issue requiring this reset so often.
This is because they create another problem when anyone you talk to will say they have their password and just increment a number for every password change. That way they’re not having to remember a whole new password every few months. So there’s never much of a change in anyones password during these rotations.
- abcde1 - abcde2 - abcde3 - …
Re: There’s no need to change passwords if they're robust, unique and not breached
#10Do people even actually change their passwords when there is no need to do so, just because the password is old?
This has been a standard IT policy for companies in the US for like 20 years. Probably 3/4 of the companies I've worked at over that time anyway.
NIST actually changed their recommendation relatively recently and no longer suggests periodic password changes without reason.
> Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.
Source: https://pages.nist.gov/800-63-3/sp800-63b.html#memsecretver