Following password ‘myth’ ends up ‘being worse’ as all iPhone and Android owners urged to ignore common log-in rule

CHANGING your passwords regularly might be a terrible idea.

That’s according to leading security experts who say the habit of “password rotation” might be doing more harm than good.

Alamy

It’s a common belief that it’s important to regularly change your passwords to stave off hack attacks.

But security experts say updating your passwords on an iPhone or Android every three months has some big downsides.

“No, you don’t have to change your password every 90 days,” said Ashley D’Andrea, of Keeper Security.

“This idea of regularly changing your password is known as password rotation.

“The main benefit of changing your passwords so often is to prevent unauthorized users from accessing private information.”

Sometimes changing your password is necessary.

For instance, if you’ve had an alert that an account has been compromised, it’s important to update the log-in as quickly as possible.

But by placing the pressure of changing all passwords every 90 days on yourself, you’re bound to run into trouble.

WHAT’S WRONG WITH CHANGING PASSWORDS?

“For personal accounts, changing your passwords every 90 days can actually end up being worse than keeping them the same,” Ashley warned.

“Setting up Multi-Factor Authentication (MFA) is a better alternative to changing your passwords every 90 days.

“Because frequent changes could lead you to start using weaker passwords or reusing old passwords. Enabling MFA gives your accounts an added layer of security.”

For instance, Ashley warned that people who change their passwords regularly will often tend towards easy log-ins that are easy to remember.

Typically that means adding in something memorable like a pet’s name, favorite food, or a local street.

STRONG PASSWORD TIPS – DON'T IGNORE THEM!

Here's what you should be trying...

• Use a Mix: Combine uppercase letters, lowercase letters, numbers, and special characters.
• Avoid Common Words: Steer clear of easily guessable words and phrases.
• Length Matters: Aim for passwords that are at least 12 characters long.
• Unique Passwords: Use different passwords for different accounts to enhance security.
• Passphrases: Consider using a series of random words or a memorable sentence.
• Memory Tricks: Use mnemonics or acronyms to remember complex passwords.
• Password Managers: Utilize password management tools to store and generate strong passwords.

This makes it much easier for those passwords to be compromised.

Similarly, feeling like you have to remember new passwords leads people to re-use log-ins.

That’s a major problem because it means a single account being compromised sparks a chain reaction – where other log-ins that share the same password are also hacked.

Even similar passwords (like changing the number at the end) can be compromised in this way.

Apple

Plus, if you’re constantly changing log-ins (and you’re not using a password manager) then you run the risk of forgetting passwords altogether.

That can be a massive inconvenience, especially if you’re in a rush.

And the biggest downside of all: the time it takes.

If you’ve got dozens of accounts, it’s a huge pain to change all of your passwords.

And if it’s not bringing big benefits then you’re only wasting time.

However, the security experts did admit that companies (not regular people) should practice password rotation.

That’s because big companies can set the process to happen automatically – and can enforce strict rules about the types of passwords you choose.

So don’t panic if your work is asking you to regularly change your password: it’s a good idea.