Mandatory password changes -- not as secure as you think

Mandatory password changes -- not as secure as you think

Frequent, mandatory password changes are not just unnecessary.  According to studies on the subject, they  may in fact be harmful to security.

“Users who are required to change their passwords frequently select weaker passwords to begin with, and then change them in predictable ways that attackers can guess easily,” Lorrie Cranor, chief technologist at the Federal Trade Commission  wrote in a recent blog post. “Unless there is reason to believe a password has been compromised or shared, requiring regular password changes may actually do more harm than good,” she said, adding that simply changing a password after a compromise will not be effective if related security issues are not addressed.

An earlier study out of the University of North Carolina at Chapel Hill supports this notion. The researchers studied the security of passwords belonging to over 7,700 accounts associated with former university students, faculty and staff who were  required to change their passwords every three months.

“We believe our study casts doubt on the utility of forced password expiration,” said the authors said. “Even our relatively modest study suggests that at least 41 percent of passwords can be broken offline from previous passwords for the same accounts in a matter of seconds, and five online password guesses in expectation suffices to break 17 percent of accounts.” The researchers went on to say they found the survey’s results “alarming, albeit not surprising.”

The big problem? Users tend to generate fresh passwords based on old passwords, allowing attackers who know a user’s previous password to easily guess the new password. While not part of the study, the researchers hypothesized that “the increased mental effort required to choose a good password discourages these users from investing that effort again to generate a completely new password after expiration.”

Instead, the authors suggest requiring users to create significantly stronger passwords, and IT managers should consider alternatives to passwords, such as biometric security.

Likewise, Sonia Chiasson and Paul C. van Oorschot of Carleton University quantified the security advantage of password expiration policies in a report and found similar results. Mandatory password changes only moderately hinder a specific type of attack -- from attackers who know a user’s password.

“However, it provides little help against numerous other attacks, including those which upon first access immediately procure target files, set up a back door, or install keystroke-logging software or other persistent malware to render ineffective subsequent password changes,” the authors noted. Thus, “the security benefit of password-aging policies are at best partial and minor,” they concluded.

Based on mounting evidence against forcing users to change passwords, “the burden appears to shift to those who continue to support password aging policies, to explain why, and in which specific circumstances, a substantiating benefit is evident,” they wrote.

Cranor suggested that system administrators can adopt password hashing functions, such as bcrypt, to make it significantly harder for attackers to guess passwords without inconveniencing users.

“There is also evidence from interview and survey studies to suggest that users who know they will have to change their password do not choose strong passwords to begin with and are more likely to write their passwords down,” Cranor said. “In a study I worked on with colleagues and students at Carnegie Mellon University, we found that CMU students, faculty and staff who reported annoyance with the CMU password policy ended up choosing weaker passwords than those who did not report annoyance.”

Organizations are beginning to take notice. The British government issued guidelines last year encouraging its systems administrators to simplify their approach to passwords, eliminate regular interval password changes and use automated controls to defend against automated guessing attacks rather than relying on users to generate and remember complex passwords.

“Encouraging users to make the effort to create a strong password that they will be able to use for a long time may be a better approach for many organizations, especially when combined with slow hash functions, well-chosen salt, limiting login attempts and password length and complexity requirements,” Cranor said. “And the best choice -- particularly if your enterprise maintains sensitive data -- may be to implement multifactor authentication.”

About the Author

Kathleen Hickey is a freelance writer for GCN.

inside gcn

  • operational controls (cl2004lhy/Shutterstock.com)

    Protecting critical infrastructure in your own backyard

Reader Comments

Mon, Jun 13, 2016 wolfkin Canada

While interesting it does ignore one of the other solutions. Namely, using a password manager which can create complex passwords that the user doesn't need to manually memorize. I also understand why that solution isn't "viable" because it's not actionable. You can't FORCE people to use managers in part because of ethics, in part because of the manpower and in part because the mechanics of enforcing compliance just aren't there. What it does ignore is that a useful password manager that's easy to use would be very useful in solving this problem. While acknowledging that such things aren't really available yet. KeePass is free and effective but while I understand it.. it's not casual user friendly. A lot of the most friendlier looking options however cost. More frustratingly they cost in subscriptions requiring endless payment for security. Imagine if you have to pay a monthly fee to have a key to your house. Most people would opt out of keys.

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group