0

I have locked myself out of my own account because my password was so strong, and this site tells me how long hackers will take to hack your password.

Is it advisable to change your password every now and then? If so, how often is appropriate? My brain has had it's toll...

|improve this question
  • 1
    It's advisable to do what you can deal with so you don't get locked out. Nobody's got a perfect brain after all. Changing your password simply by altering one letter won't do much at all for your security -- the attacker who stole a previous password will guess the new one. Instead, choose your battles and make sure you have two or three strong passwords that you type often enough to remember no matter what. And use these for a password manager and for your email accounts -- for the rest, generate random passwords and let the password manager do its job. – Steve Dodier-Lazaro Sep 1 '16 at 9:54
  • 1
    One important question for the clarity of your question: are you asking if it's better to change passwords often so that you can have a simpler / shorter password? – Steve Dodier-Lazaro Sep 1 '16 at 9:56
  • Regardless of the exact question you wanted to ask, the answer is "use a password manager" – Stephane Sep 1 '16 at 9:58
  • forgetting about hackers for a moment, if someone else somehow knows your password, they have access until you change it. An ex or cowork is far more likely than a stranger... – dandavis Sep 1 '16 at 10:08
1

Why are we sometimes encouraged to change our passwords periodically? Two reasons:

  • Passwords are (hopefully) stored in hashed form, meaning that it is supposed to be impossible to get the plaintext password even if you manage to steal the database. If the password is weak, or the hashing bad, it is possible to brute force the password. This can take time, even on a very fast computer. If you change your password every month, and brute forcing the password takes two months, the attacker is out of luck.
  • If say your collegue steals your password by peaking while you type he can read your email and spy on you. If you change your password regularly, you will eventually shut her out.

So changing your password is positive in theory. But it is associated with a cost - having to memorize the new password. If having to pay that cost forces you to take other cheap short cuts in other areas, you may end up less secure because of it.

I would use this priority list:

  1. Never use stupidly simple top 1 000 passwords like password1 or 123456.
  2. Never reuse the same password on multiple sites.
  3. Use reasonably strong passwords.
  4. Change your password every now and then.

If implementing #4 causes you to cheat on #1 - #3 to be able to keep all the passwords in memory, you are doing yourself a disservice. Fortunately, there is an easy way to fullfill #1 - #3 without spending any brainpower at all - just use a password manager. There are plenty of free alternatives.

Even with a password manager you might want to change your password periodically in case someone got hold of it. Good thing is that it is now very easy to do, since you don't need to remember it.

|improve this answer
  • a dozen-char "salt" helps remember dynamic passwords. Adding "yellowban@na" to the end of your all your current crappy passwords makes them much stronger. Next time, you can change your salt to "orangeban@na", and eventually to "yellowstrawb3rry". pick your adjective:noun pairs for max recall... – dandavis Sep 1 '16 at 10:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.