In the course of my computer working I daily use dozens of username/passphrase pairs. Within the limits of my understanding and restrictions I apply the best practices for security. Unfortunately I have limitations on my abilities to employ some measures. I am often using the Internet in high-risk situations, such as on a public computer, or some other device not under my control, and using open public WiFi networks.
Some of the measures I employ are:
- Never use the same passphrase for two purposes
- Never reuse a passphrase, or minor modifications of prior passphrases
- Personal minimum of 14 characters, unless the environment restricts it to less
- Limit characters to 7-bit ASCII printable (guaranteed to be typeable anywhere)
- Include all four complexity groups (upper/lower alpha, numeric, punctuation/special)
- Don't use words, even converted with character substitutions, i.e.: password as p4s5w0rd
- Passphrases have no reference to the username or their purpose
- Security questions, or reset questions, have fake answers (treated like a second passphrase)
- Don't use any information which relates to me, my life, or my past, as material for passphrases
- PGP keys are created, or renewed, on an air-gaped box, and the primary private key never leaves there
- Exported PGP keys have their passphrase changed before exporting
- PGP keys have a short life, expiry dates typically in a six month window
- Most importantly, nothing I create, including hints, is written/saved anywhere except in my cranium
- System generated recovery phrases (such as for crypto wallets) are saved in encrypted storage only
Some of my limitations are:
- Unreliable access to SMS
- Lack of ability to install authenticator apps
- Inability to rely on password keepers
My limitations, and exposures, are non-negotiable. I'm well aware of the arguments for (and against) password keepers, 2FA, physical keys, etc., and they are not germane here as they simply are not available as a solution for me.
I am also aware of the argument against a policy of password rotation forced on users by the system, or management. The chief point being that employee John Q. Public might pick a good passphrase originally, but then change it each time it is required by adding on a rotating, or incrementing, part. Thus,
SuperDuperSecret2020 ..., or
MyGoodPhrase becomes the rotating set of
MyGoodPhraseDec. In my case the argument is spurious as it is not a policy I'm required to follow, but one I'm choosing to apply; and the simple modifications that it commonly triggers in users does not applied in my case, as I know, and want, better.
The question I am asking is not What measures can I employ for security? The question is should I continue to do password rotation at all, and how often should I rotate my passwords? The how often presumes medium sensitivity with reduced frequency for low-risk or lower sensitivity (account on PcPartsPicker, for example), and increased frequency for high-risk or highly sensitive accounts (my bank account, for example). A suspected compromise, of course, has a frequency of now, as soon as the breach is reported, or suspected.
This is not a trivial concern either, as the last time I did a reset across the board, online and local passphrases, it was a three-day long event.
This also could affect how I apply requirements on passwords for users on systems and sites I maintain, and client access to services.