Changing your password every 3 months sounds good in theory -- if you have only one account in world. But what if you live in the real world? In that case, you probably have 50-100 accounts, each with its own password and user name. You can make this plenitude of accounts less onerous by using the same name and password for multiple accounts. But if your IT department insists that you change passwords every 3 months, how do you keep track of them? Most people write them down -- in a file on the computer or PDA, on a white board, or on post-it notes displayed prominently on the monitor for any and all too see.
With so many passwords to remember, this is a perfectly rationale way of coping with the changing-password demand. Of course, it must also be admitted that it has the opposite effect of the intended purpose. Rather than improving security, forcing users to change passwords makes security weaker, since everyone has to find some coping mechanism for dealing with the short expiration. Under the flag of strengthening security, this practice actually weakens it.
# Je pense que c'est celui là
Posté par WaVeR . En réponse au journal Le changement de password pue du rond. Évalué à 8.
With so many passwords to remember, this is a perfectly rationale way of coping with the changing-password demand. Of course, it must also be admitted that it has the opposite effect of the intended purpose. Rather than improving security, forcing users to change passwords makes security weaker, since everyone has to find some coping mechanism for dealing with the short expiration. Under the flag of strengthening security, this practice actually weakens it.
Source:
http://dontgogentle.blogspot.com/2007/12/magazine-passwords-(...)