{"id":3967,"date":"2020-07-24T08:35:58","date_gmt":"2020-07-24T06:35:58","guid":{"rendered":"https:\/\/blog.passwordsafe.de\/?p=2482"},"modified":"2021-12-21T16:30:15","modified_gmt":"2021-12-21T16:30:15","slug":"password-guidelines-protection-or-risk","status":"publish","type":"post","link":"https:\/\/www.passwordsafe.com\/en\/blog\/password-guidelines-protection-or-risk\/","title":{"rendered":"Password Rules – Protection or Risk?"},"content":{"rendered":"

Employees are often dictated to change their passwords at regular intervals as well as its length and complexity. Thanks to additional effort, they are not so keen with those ideas and security experts are increasingly asking themselves: “Are such guidelines even effective?” We say quite clearly: “Yes and No!” Why it can be both advisable and even dangerous to stick to clearly defined rules<\/a> when protecting passwords \u2026<\/strong><\/p>

When rules do more harm than good<\/h3>

It has long been unclear, not only among users, what constitutes a strong password and how it should be maintained. Now the Federal Ministry of the Interior for Security (BSI<\/a>) has deleted the text passage calling for a regular password change. The paragraph on complexity<\/strong> and length<\/strong> has also disappeared. Security experts advise that in the long term<\/strong> it is better to remember a really secure password and not to bother with minimum information.<\/strong><\/p>

To change or not to change<\/h3>

But why do password changes make actually sense even though a strong password<\/strong> is already in use? The reason is: There may already be attackers in companies that have not yet been tracked down. Frequent password changes successfully lock them out. But if the password is changed at the expense of quality, the security risk can even increase. In addition: The longer a password is used unchanged<\/strong><\/a> – in doubt even for several applications or services – the greater the risk of compromise.<\/p>

“Not without my old password!”<\/h3>

Nevertheless, employees often feel too much pain when they are separated from their hard-earned mnemonics and character strings.<\/strong> You can’t blame them – it’s like a mammoth task to remember a unique password for each account – and then to change it every few weeks. No wonder that employees resort to insecure tactics to fulfil the last rule of their password policies. So they don’t replace the password but only change it partially so that they can still remember it. The most popular tactics are \u2026<\/p>