Changing Passwords

Schneier Fact No. 27[1] seems particularly relevant in light of the [very useful, but preaching to the choir maybe?] advice he's handing out here:

Most people use passwords. Some people use passphrases. Bruce Schneier uses an epic passpoem, detailing the life and works of seven mythical Norse heroes.

No wonder he uses a password manager, eh?

[1] http://www.schneierfacts.com/fact/27

This advice is back-assward.

The attacker who uses your stolen password is just as likely to be trying it a year from now than he is to be trying it the moment he captures it. Maybe he's not even the person who originally stole it. A stolen password for an account whose password isn't regularly changed is a backdoor that can't be patched or detected. It's actually more valuable in some ways than a rootkit.

This isn't idle punditry. Maybe once a year, I end up on a penetration test that works its way onto internal networks or desktops, and every one of those engagements invariably has a "here's the chapter of the report where we ended the universe" because one person saved a password somewhere a year ago and never changed it.

Yes, attackers will mount active attacks, and yes, attackers will install backdoors. But they will also sweep your machine for textual passwords and then bank them.

There are classes of passwords that don't merit regular changes. Your one-off passwords for sites like Reddit (please, don't share passwords between sites) don't need changing. I'm also not religious about changing single-purpose rarely-changed Keychain-generated passwords.

The rest of them, change at least once a year.

It's amazing how much of this is alleviated by something like 1Password or LastPass which I currently use. It'll generate a strong random password for me and remember it so I don't have to write it down. Changing passwords is just as easy.

> And two, it's far more important to choose a good password for the sites that matter -- don't worry about sites you don't care about that nonetheless demand that you register and choose a password...

I actively use terrible and crappy passwords for certain sites, when I'm more worried about someone getting the password than someone getting access to my account on that site.

I use this process: http://www.joelonsoftware.com/items/2008/09/11b.html

Works even better now that there's an iOS client: http://www.passwordtouch.com/

Actually I think that forcing users to change their passwords doesn't really improve security and it may well decrease it.

Good passwords are hard to memorize and if I'm forced to change it every few months then I can do two things: change it as little as possible (e.g add a number or a character at the end and cycle between them as allowed) or use a weak password (and maybe do the same with it).

Now if one has a lot of accounts and passwords and tries to be safe and use an app like passwordsafe then the ignorant service operators (e.g. my bank...) who force frequent password changes can turn life into a really bad experience forcing us to do password changes every few days on one system or the other (or just force the user to give up on secure passwords).

Now if someone wants to secure their system then they should use two factor authentication. Now that everybody has a mobile phone, basically everybody has a secure token. (I know that mobile phones are not that 'tamper resistant', still they are something that an attacker has to have their hands on. And you'll probably notice if you loose your phone sooner than you would notice your purse.)

  > Someone committing espionage in a private network is more likely to
  > be stealthy. But he's also not likely to rely on the user credential
  > he guessed and stole; he's going to install backdoor access or
  > create his own account. Here again, forcing network users to
  > regularly change their passwords is less important than forcing
  > everyone to change their passwords immediately after the spy is
  > detected and removed -- you don't want him getting in again.

Most likely if a {corporate,government} spy is caught, the institution will try to keep it under wraps as much as possible. Only telling employees to change passwords in the event that such a thing happens is tantamount to admitting it having happened.

If you worked for a company that never made you change your password, and all of the sudden there was a one-time corporate directive that everyone had to change their password, what would you think? That somehow security had been compromised.

I thought he might finish off there at the end with key passwords, like the email account that all the change of password notifications go to.

As once that one's compromised, you've pretty much been compromised everywhere on the internet apart from maybe banks that require phone or fax steps for password changes.

You would think changing passwords every month is more secure, when in fact is much less secure for the reasons he explained.

People tend to get tired of remembering passwords so they write it down on a post-it and stick it on the monitor.

How is that for secure?