8

A password manager can store lots of sensitive information like passwords, pins and so on. To access this data, we should use a strong password/passphrase in order to protect our data. This password is more or less a master password.

Is there any reason why I should change this password regularly?

In my case, I use KeePass with a strong password that is only known by me. Furthermore, I would like to exclude password manager solutions like LastPass (who got hacked lately) since online accounts should have changing passwords.

11

You should change your password when you suspect that the old one has been compromised. This is not a question of password age; thus, we are not talking about a regular password change, but about an urgent, context-dependent password change.

Apart from a situation of (suspected) compromise, changing your password does not buy you much in terms of security. On the other hand, changing your password regularly means that you will need to invest more effort in memorizing the new passwords. This may induce you into choosing passwords that are easier to remember, possibly at the expense of randomness. In that sense, regular password change can induce a decrease in security, and thus should be avoided.

  • It's a good argument that regular password changes decrease the ability of memorization. The password I'm using is fairly complex and it's take a bit of time to keep it in mind. – user3147268 Jun 17 '15 at 17:39
  • I think your assumption should be made explicit: you are assuming that this is a strong password, which wouldn't be brute forced in any reasonable timeframe. A weak password, on the other hand, might potentially benefit in certain circumstances from a password change - but then, you'd be better off just swapping to a strong password, anyway. – AviD Jun 17 '15 at 18:53
  • 2
    If the password is breakable, then regular change improves security only if the change occurs before the attacker loses patience and moves on to something else. I.e. it makes things better if you change the password every hour, but hardly if you change it every three months. – Thomas Pornin Jun 17 '15 at 18:59
  • @ThomasPornin Every password is breakable (if you've enough time). I'm only storing my password manager locally, other consider a sync via the cloud. If my computer got compromised or a cloud account gets hacked the password needs only to resists long enough to allow the user to change all his passwords and other credentials before the hacker can gain access to those accounts. Concluded is a strong password necessary to resist an attack. – user3147268 Jun 18 '15 at 10:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.