A growing number of cyber security experts, including tech giant, Microsoft, say that regularly changing passwords may actually jeopardize users’ safety.
In a blog post published late last month Microsoft quietly removed ‘password expiration’ — the process of regularly sunsetting old passwords — from its baseline security settings.
For decades, conventional cyber security wisdom dictated that in order to mitigate the chance of a hackers using a stolen password to access sensitive information, one should regularly change those credentials.
The logic being that one’s sensitive data will be compromised inevitably, and in order to stay ahead of that breach, users should act preemptively.
Now, Microsoft’s stance on the strategy can be encapsulated most succinctly by one excerpt of a recent blog post in Technet — a portal for security and IT professionals.
‘Periodic password expiration is an ancient and obsolete mitigation of very low value,’ reads the post, authored by Microsoft consultant Aaron Margosis.
One major factor behind the turn away from a password expiration tactic has to do with underlying habits in most people’s method of creation.
Instead of choosing passwords that are difficult — those that are at least 11 characters long and consist of random numbers and symbols — users often choose codes that are easy to remember.
As the evolution of passwords progresses, this habit means that many users may inadvertently change the codes to something that is either equally as weak or potentially even more easily deciphered by expert crackers.
Ars Technica notes that using a type of online password dictionary based on previous data breaches, hackers are able to automate the cracking process of ‘hashed’ or encrypted passwords.
Using a regular graphics card, hackers can process a whopping eight billion passwords encrypted by the simplest algorithms, says Ars Technica.
So what can people do to ensure their security online? Aside from formulating strong passwords with symbols and numbers, Margosis says that users should only change their passwords if they know that they’re compromised.
According to Google, simple tools like two-factor authentication — which requires suspicious or new sign-ins on unrecognized devices to input an additional password that is sent to one’s phone or email — also work.
The company’s research shows that enabling the second layer of security blocked an overwhelming 76 percent of targeted phishing attacks and almost all attacks launched by a bot.
Despite the measures effectiveness, however, many users still choose not to opt in, either because they aren’t aware of the benefits or they would rather not go through the extra steps to log in to associated accounts.
According to Margosis, at the end of the day, security measures are only as strong as the person who is employing them
‘If your users are the kind who are willing to answer surveys in the parking lot that exchange a candy bar for their passwords, no password expiration policy will help you,’ he wrote.
