so, change it from password1 to password2? ok

I hate it when I'm forced to change my passwords. My passwords are very secure and unless you think someone has access to your account, there's really no reason to change them. Worst is when they assume you're too incompetent to make your own password and set a bunch of ridiculous requirements. You know what happens when I can't use the password I want? I have to write it down on a post-it note so I can remember it. Yeah, *that's* secure...

agreeing with abge, who'd have thunk it.

but no, just make sure you don't use the important passwords anywhere else. And make sure your facebook password isn't used anywhere else (hacking into facebook to steal passwords would be very valuable, thus it is a big target, and you might not know it has happened. So don't use that password for you bank)

Orath makes a good point.

I have a "junk" pw for most accounts that I don't really care about. However, all of my bank and email pws are all different and very long.

Also do not make your username and password the same! I can't tell you how many things I have hacked because of it. It takes the fun out of things.

Business Password Rule 1.: Change at Least every 40 days.

Rule. 2: 16 # bankcard accounts mathematically can be broken; your supercomputer of the past is the Laptop today and after a few million passes, yr ATM and account #s are open books.

Rule 3. Valuables under mattresses might be bound to turn up. Post-It notes in the cublicle can fall on sighted eyes. Human nature has not changed a bit over aeons.

"Change at Least every 40 days."

This is horrible advice.

People with a secure password are fine and do not need to change it every 40 days. What you do need to do is make sure your security question on sites isn't something stupid like "What is my grandma's maiden name" which any idiot can find on any of the family tree sites. A secure password is worthless if you let someone get around it by knowing your cats name.

I use a pretty garbage password (and the same one) for all sites that the loss of them would not drastically impact my life in any appreciable way. But I agree with abge, especially about the rules. My school had it so you had to use letters and numbers, but the beginning and end couldn't be numbers, and it didn't recognize capitalization and you couldn't use punctuation. Thanks for making it easy for people to decode them!

Our obsession with strong passwords and turning them over is silly. Just look at every major break-in in the past. Phishing, SQL injection, application vulnerabilities. When was the last time you had someone mass-brute force or dictionary passwords? And every place worth protecting has maximum attempt limits. Password strength is definitely something, but it's not as big as we make it out to be.

Your defense is like your outer wall. A strong password is like a good coat of paint. Keeps the rain out, fun to talk about, security-wise not really game changing.

"I hate it when I'm forced to change my passwords. My passwords are very secure and unless you think someone has access to your account, there's really no reason to change them. Worst is when they assume you're too incompetent to make your own password and set a bunch of ridiculous requirements."

I can understand your frustration, but you are completely unlike most computer users. As someone who has administered business networks with hundreds of users, I can tell you that MOST people (if it weren't for password requirements like these) would use dictionary words and birthdates for their password and never change it. The vast majority of users are completely oblivious and unconcerned about computer security. I had the president of one company that did about $10 million in business every year try to order me to reset everyone's password to the same six-character dictionary word so "things would be easier" - it took about 20 minutes to talk him out of it (and we both wound up firing each other a few weeks later, thank God). These password requirements exist for very good reasons.

" You know what happens when I can't use the password I want? I have to write it down on a post-it note so I can remember it. Yeah, *that's* secure..."

When you change the password, logging out and back in of the system you're on will help burn it into memory so you don't have to write it down.

"and we both wound up firing each other a few weeks later"
You fired each other? I'm a little confused, but intrigued by the story.

@ 2ndWhiteLine: What was the point of this thread?

"You fired each other? I'm a little confused"

I'm a self-employed computer/networking consultant. This #(%&! and his company was my customer. We didn't get along too well for a number of reasons, (one being that he was a severe technophobe). We both came to the conclusion it was best to cease doing business with the other at the same time.

I think I know what Tolstoy meant by "firing each other". It's when you say "I quit" at the same time he says "You're fired." I usually let them fire me if I think a mutual split is about to occur because that means they probably don't have grounds and I can get unemployment, like at my last job where "my attitude was bringing down morale." Several people left for other positions in the next couple of months in part due to the way they treated me (and other employees too). :-)

Well I can agree with 2ndWhiteLion on this one. I've had thieves break into my webdip account, steal my credit card information, and pay the salary of the Al Qaeda weapons technician for a whole year while he developed a nuclear warhead. It's a good thing that the U.S. army caught and killed these guys before more damage was done. I've found that it's best to change my password every time I log on, because you never know who's interested in your webdip password.

Sorry, was typing that when Tolstoy posted his. Been there done that as well. You like to leave a customer on a high note, but it doesn't always happen, especially when the customer is an asshole and you know his business is doomed to failure because of it.

One more rule... Don't change you rpassword on February 1st. The IP packet sniffers are out in force. If yo didn't do it a week or so ago, wait until mid February or later. Never *ever* change it when the phishers are expecting you to.