Never change your password ? Not sure I would agree to Glenn

44

For web sites, I would expect modern practices, but for corporate systems, as others have already mentioned, its a different ball game entirely. I recall when my current employer was client of previous employer and I had a diagram of the 300+ systems we were in the process of changing. Single Sign On became a thing early on in places like this. And when you use SSO, the lowest common denominator wins. Given there are systems over 20 years old, you can guess what it’s like. We have to change our password every 90 days.

What services do you use that let you create lots of addresses like this?

45

Google Workspace. You can create up to 30 aliases for each user, or you can set up a user with a catch-all address which accepts any message sent to a domain.

  • a catch-all address accepts any message not addressed to an actual user
1 Like
46

Disclaimer: I do not have the time to really look for literature and recommendations for the US because they vary from country to country. What follows deals with the situation in Germany.

I my day job, one of my tasks is to audit the annual accounts of companies. One part of these audits also deals with IT security. Recurring mandated password changes are being considered as security risk these days.

And thank god, there is a ripple effect. Experts started talking about those risks many years ago, but it took quite an amount of time until the big players agreed.

  1. Create strong unique passwords and do not reuse them - Choosing and Protecting Passwords | CISA. Have a read what is considered strong. Some of us might be surprised how easy it is to have a very strong password that can be remembered easily.

  2. Stick to a password unless you have a valid reason to change it. Why? Because changing strong and unique passwords frequently without forgetting the latest one is not how our brain works. And a secure password for our password manager (yes, we all need one) is only secure as long it is being stored in our brain and maybe on a note in a safe place in case we forget…

Starting about 10 years ago, several security researchers made the case that frequent time-based password changes might actually do more harm than good. Those researchers faced a strong and fierce opposition. It took time until more and more researchers, organizations and companies realized that those researchers had a valid point. Today, even official IT security agencies are promoting this cause.

2016 - UK’s information security agency warned that “making users change passwords frequently could actually make systems less secure” - Changing your password regularly is a terrible idea, and here's why | ZDNet

2019 - Microsoft gave in (to some degree hell froze over): no password-expiration policies any longer in Windows - Security baseline (FINAL) for Windows 10 v1903 and Windows Server v1903 | Microsoft Docs

February 2020 - the German BSI (federal agency for security in information technology) updated its base protection compendium and stated that passwords have to be changed in case unauthorized persons have knowledge of the password. A system or application only should request a password change from a user if there is a valid reason. A request to change a password just because a certain time interval has passed should be avoided. Instead, measures have to be taken to detect if a password has been compromised (see ORP.4.A8, ORP.4.A23 [German]).

I am confident that local agencies in different countries have similar policies in place. If a company does not follow these recommendations without valid reasons, auditors regard that company at risk over here. In this case, a company will have to explain why it does not follow those rules.

So, yes, I agree with Glenn. :wink:

1 Like
47

Bruce Schneier is a well known security expert. He also recommends to NOT change your password regularly:

Don’t bother updating your password regularly. Sites that require 90-day — or whatever — password upgrades do more harm than good. Unless you think your password might be compromised, don’t change it.

https://www.schneier.com/blog/archives/2014/03/choosing_secure_1.html

3 Likes
48

thank you all for bringing out a lot of good discussions and references to great studies

I think the TL;DR is that

there is no NEED for changing good, strong password regularly, however sometimes we are FORCED to do so by organisations who set the password policies

2 Likes
49

In environments where things line NTLMv1 exists and Mimicatz can be used, I think it’s not so easy to make a definitive statement one way or the other.

50

By extension it is good to additionally do a scan of logins with “enforced” weak passwords and consider changing these passwords regularly, such as:

1 Like