Return to Answer

On one hand, password expiration is a terrible idea.

On the other hand, passwords are a terrible idea.

The way passwords work equates more to this scenario:

All your locks conveniently use any key you specify, however every business you enter requires a key to enter and do any business.

You could create a new unique key each time you walked into a new store but you'd be carrying around a keyring with 500 keys and you'd have to find the wallmart key every time you went shopping!

Also each store that you enter copies the key you use and tags it with your name and address--many simply throw all the key copies into a bin in the back room (Where people can occasionally sneak back and grab a few).

Also you are required to pull this key out and use it every time you do business but anyone who glances at your key (think keyloggers, video cameras, etc) can copy the key with just a glance at the original.

How often do you change your keys in this scenario?

I'm getting to the point where I just don't bother with sites that require an account and don't allow you to delegate password handling to a site that is at least somewhat security aware like Apple or Google.

As for door locks? Do companies still use individually keyed locks??? I have a card that accesses any doors I have access to--if I'm fired, someone will have to let me out the door because my key will already be dead, but everyone else's will still work. It also lets me log into any computer at work without a password (just a PIN) with public key based encryption where the private key never leaves my badge.

The combination of badge and pin is pretty hard to beat, works for both physical and computer security and requires two factors. You could accomplish the same with a phone/thumbprint/pin (2-3 factor) if you didn't want to pay for badge based security.

If you still have keyed locks then YES, Change them, OFTEN.

Do companies still use individually keyed locks??? I have a card that opens any doors I have access to--if I'm fired, someone will have to let me out the door because my key will already be dead, but everyone else's will still work. It also lets me log into any computer at work without a password (just a PIN) with public key based encryption where the private key never leaves my badge.

The combination of badge and pin is pretty hard to beat, works for both physical and computer security and requires two factors. You could accomplish the same with a phone/thumbprint/pin (2-3 factor) if you didn't want to pay for badge based security.

If you still have keyed locks then YES, Change them, OFTEN.

By changing the keys on doors all the time, you are taking the WORST part of passwords and applying it to another system.

What I'd really rather do is apply identity/encryption based technology to all computer logins AND physical locks by accessing everything through the same public encryption key where the private key safely resides in your physical possession and cannot be copied from that physical medium.

On one hand, password expiration is a terrible idea.

On the other hand, passwords are a terrible idea.

The way passwords work equates more to this scenario:

All your locks conveniently use any key you specify, however every business you enter requires a key to enter and do any business.

You could create a new unique key each time you walked into a new store but you'd be carrying around a keyring with 500 keys and you'd have to find the wallmart key every time you went shopping!

Also each store that you enter copies the key you use and tags it with your name and address--many simply throw all the key copies into a bin in the back room (Where people can occasionally sneak back and grab a few).

Also you are required to pull this key out and use it every time you do business but anyone who glances at your key (think keyloggers, video cameras, etc) can copy the key with just a glance at the original.

How often do you change your keys in this scenario?

I'm getting to the point where I just don't bother with sites that require an account and don't allow you to delegate password handling to a site that is at least somewhat security aware like Apple or Google.

As for door locks? Do companies still use individually keyed locks??? I have a card that accesses any doors I have access to--if I'm fired, someone will have to let me out the door because my key will already be dead, but everyone else's will still work. It also lets me log into any computer at work without a password (just a PIN).

The combination of an encryption based smart-badge and pin is pretty hard to beat, works for both physical and computer security and requires two factors. You could accomplish the same with a phone/thumbprint/pin (2-3 factor) if you didn't want to pay for badge based security.

If you still have keyed locks then YES, Change them, OFTEN.

On one hand, password expiration is a terrible idea.

On the other hand, passwords are a terrible idea.

The way passwords work equates more to this scenario:

All your locks conveniently use any key you specify, however every business you enter requires a key to enter and do any business.

You could create a new unique key each time you walked into a new store but you'd be carrying around a keyring with 500 keys and you'd have to find the wallmart key every time you went shopping!

Also each store that you enter copies the key you use and tags it with your name and address--many simply throw all the key copies into a bin in the back room (Where people can occasionally sneak back and grab a few).

Also you are required to pull this key out and use it every time you do business but anyone who glances at your key (think keyloggers, video cameras, etc) can copy the key with just a glance at the original.

How often do you change your keys in this scenario?

I'm getting to the point where I just don't bother with sites that require an account and don't allow you to delegate password handling to a site that is at least somewhat security aware like Apple or Google.

As for door locks? Do companies still use individually keyed locks??? I have a card that accesses any doors I have access to--if I'm fired, someone will have to let me out the door because my key will already be dead, but everyone else's will still work. It also lets me log into any computer at work without a password (just a PIN) with public key based encryption where the private key never leaves my badge.

The combination of badge and pin is pretty hard to beat, works for both physical and computer security and requires two factors. You could accomplish the same with a phone/thumbprint/pin (2-3 factor) if you didn't want to pay for badge based security.

If you still have keyed locks then YES, Change them, OFTEN.

On one hand, password expiration is a terrible idea.

On the other hand, passwords are a terrible idea.

The way passwords work equates more to this scenario:

All your locks conveniently use any key you specify, however every business you enter requires a key to enter and do any business.

You could create a new unique key each time you walked into a new store but you'd be carrying around a keyring with 500 keys and you'd have to find the wallmart key every time you went shopping!

Also each store that you enter copies the key you use and tags it with your name and address--many simply throw all the key copies into a bin in the back room (Where people can occasionally sneak back and grab a few).

Also you are required to pull this key out and use it every time you do business but anyone who glances at your key (think keyloggers, video cameras, etc) can copy the key with just a glance at the original.

How often do you change your keys in this scenario?

I'm getting to the point where I just don't bother with sites that require an account and don't allow you to delegate password handling to a site that is at least somewhat security aware like Apple or Google.

On one hand, password expiration is a terrible idea.

On the other hand, passwords are a terrible idea.

The way passwords work equates more to this scenario:

All your locks conveniently use any key you specify, however every business you enter requires a key to enter and do any business.

You could create a new unique key each time you walked into a new store but you'd be carrying around a keyring with 500 keys and you'd have to find the wallmart key every time you went shopping!

Also each store that you enter copies the key you use and tags it with your name and address--many simply throw all the key copies into a bin in the back room (Where people can occasionally sneak back and grab a few).

Also you are required to pull this key out and use it every time you do business but anyone who glances at your key (think keyloggers, video cameras, etc) can copy the key with just a glance at the original.

How often do you change your keys in this scenario?

I'm getting to the point where I just don't bother with sites that require an account and don't allow you to delegate password handling to a site that is at least somewhat security aware like Apple or Google.

As for door locks? Do companies still use individually keyed locks??? I have a card that accesses any doors I have access to--if I'm fired, someone will have to let me out the door because my key will already be dead, but everyone else's will still work. It also lets me log into any computer at work without a password (just a PIN).

The combination of an encryption based smart-badge and pin is pretty hard to beat, works for both physical and computer security and requires two factors. You could accomplish the same with a phone/thumbprint/pin (2-3 factor) if you didn't want to pay for badge based security.

If you still have keyed locks then YES, Change them, OFTEN.