Following password ‘myth’ ends up ‘being worse’ as all iPhone and Android owners urged to ignore common log-in rule
CHANGING your passwords regularly might be a terrible idea.
That’s according to leading security experts who say the habit of “password rotation” might be doing more harm than good.
It’s a common belief that it’s important to regularly change your passwords to stave off hack attacks.
But security experts say updating your passwords on an iPhone or Android every three months has some big downsides.
“No, you don’t have to change your password every 90 days,” said Ashley D’Andrea, of Keeper Security.
“This idea of regularly changing your password is known as password rotation.
“The main benefit of changing your passwords so often is to prevent unauthorized users from accessing private information.”
Sometimes changing your password is necessary.
For instance, if you’ve had an alert that an account has been compromised, it’s important to update the log-in as quickly as possible.
But by placing the pressure of changing all passwords every 90 days on yourself, you’re bound to run into trouble.
WHAT’S WRONG WITH CHANGING PASSWORDS?
“For personal accounts, changing your passwords every 90 days can actually end up being worse than keeping them the same,” Ashley warned.
“Setting up Multi-Factor Authentication (MFA) is a better alternative to changing your passwords every 90 days.
“Because frequent changes could lead you to start using weaker passwords or reusing old passwords. Enabling MFA gives your accounts an added layer of security.”
For instance, Ashley warned that people who change their passwords regularly will often tend towards easy log-ins that are easy to remember.
Typically that means adding in something memorable like a pet’s name, favorite food, or a local street.
STRONG PASSWORD TIPS – DON'T IGNORE THEM!
Here's what you should be trying...
- Use a Mix: Combine uppercase letters, lowercase letters, numbers, and special characters.
- Avoid Common Words: Steer clear of easily guessable words and phrases.
- Length Matters: Aim for passwords that are at least 12 characters long.
- Unique Passwords: Use different passwords for different accounts to enhance security.
- Passphrases: Consider using a series of random words or a memorable sentence.
- Memory Tricks: Use mnemonics or acronyms to remember complex passwords.
- Password Managers: Utilize password management tools to store and generate strong passwords.
This makes it much easier for those passwords to be compromised.
Similarly, feeling like you have to remember new passwords leads people to re-use log-ins.
That’s a major problem because it means a single account being compromised sparks a chain reaction – where other log-ins that share the same password are also hacked.
Even similar passwords (like changing the number at the end) can be compromised in this way.
Plus, if you’re constantly changing log-ins (and you’re not using a password manager) then you run the risk of forgetting passwords altogether.
That can be a massive inconvenience, especially if you’re in a rush.
And the biggest downside of all: the time it takes.
If you’ve got dozens of accounts, it’s a huge pain to change all of your passwords.
SIGNS YOUR ANDROID PHONE IS INFECTED
Here's Google's official list of signs that you might have malware on your Android phone...
You may have malware on your device if:
- Google signed you out of your Google Account to help protect you from malware on your device.
- You notice suspicious signs on your device, like pop-up ads that won’t go away.
Device symptoms
- Alerts about a virus or an infected device
- Anti-virus software you use no longer works or runs
- A significant decrease in your device’s operating speed
- A significant, unexpected decrease in storage space on your device
- Your device stops working properly or working altogether
Browser symptoms
- Alerts about a virus or an infected device
- Pop-up ads and new tabs that won’t go away
- Unwanted Chrome extensions or toolbars keep coming back
- Your browsing seems out of your control, and redirects to unfamiliar pages or ads
- Your Chrome homepage or search engine keeps changing without your permission
Other symptoms
- Your contacts have received emails or social media messages from you, but you didn’t send the emails or messages.
And if it’s not bringing big benefits then you’re only wasting time.
However, the security experts did admit that companies (not regular people) should practice password rotation.
That’s because big companies can set the process to happen automatically – and can enforce strict rules about the types of passwords you choose.
So don’t panic if your work is asking you to regularly change your password: it’s a good idea.