Many online services ask you to change your password every two or three months to keep your account secure. In fact, it's a very controversial security measure, as many people consider it completely wrong.
The Federal Trade Commission's chief technologist, Lorrie Cranor, debunked the myth earlier this week at a security conference in Las Vegas.
The technologist argued that services that require periodic password changes could have the opposite effect, making your password less secure. The reason is that when users are required to change their password, they end up using their old password, with some minor change.
It might change a lowercase letter to an uppercase letter. Or it might add an extra letter or character to the end. Researchers call these little tricks “morphs,” and hackers are well aware of them.
Thus, password cracker manufacturers can anticipate these transformations in their scripts and cracking routines.
"UNC researchers reported that people who had to change their passwords every 90 days, use a pattern and do what we call morphing," Cranor said, according to Ars Technica.
“They take their old passwords, change them in some way, and so they have a new password.”
Cranor cited a UNC study from 2010 that examined data from 7,700 accounts that were required to regularly change their passwords.
Security expert Bruce Schneier agrees.
“I've said for years that it's not good security advice to encourage bad passwords.”
This doesn't mean it's not a good idea to change your password. If your password was in a major breach, like LinkedIn's, and you use it on other sites and services, you should definitely change it.
A large one (with many random characters, letters (lowercase & uppercase) and numbers) is harder to crack, as it limits the chances of someone guessing it and adding it to a dictionary used by password crackers
