Time-based (expiry) password enforcement leads to poor password choices

If you work for an organisation where someone else has some influence over the security of your account, you may be subject to a policy of password expiry. Every 30, 60 or 90 days, you receive a prompt that advises you to change your password - if you ignore it, the prompts get increasingly more aggressive - until one day you log in and you're forced to enter a new password to continue.

Proactive account security is something I absolutely champion - but not like this.

What's wrong with forcing regular password expiry?

Passwords are a weak point of security, always have been - and until we rethink our approach to account security, probably always will be. But forced expiry has a similar effect on security as abstinence has on sex education. It looks like an idea that should be good, but it doesn't address the underlying issues.

The weak link in this chain is us; users. We're told that we have to have at least 8 characters, at least one of those must be upper case, at least one number and one special character. So as we force our users into scenarios of choosing obscure and hard-to-remember passwords, we add to that, the forced policy of having to come up with a new one every expiry cycle.

People are more likely to adopt poor password techniques

So they've got their password - they can't remember it, but it's ok because they can write it down. Nowhere obvious (of course), a blank page in the back of a notebook (no one will ever even realise that it's a password...right?).

What is arguably more likely is a couple of issues that make forced expiration a 'good idea-poorly executed'.

1. People are more likely to replicate passwords (i.e. use the same password for lots of systems). I get it, we've all been guilty of it I'm sure - but using the same password weakens every system it's used on. If someone somehow gains access to that one password, it's going to make it a heck of a lot easier to gain access to the other systems it enables access to.
   
   
2. People are more likely to repurpose passwords. You find a password that meets those all-important criteria set by your network administrator, but upon the first cycle of it expiring, you simply use the same password and pop a "1" on the end - the next cycle, a "2" and so on.

And that's the issue - it does nothing to discourage poor habits; in fact, one might argue that it encourages them!

It lacks the educational component that we need to get right (first). We should be helping our communities what a good, strong password looks like - help them understand why they should care.

Encouraging users to think of passphrases rather than passwords is a solid option - "Password12" is [hopefully] obvious why it's so poor, "Password13" isn't any better. JugTabletFreshner (compiled of three things that are in front of me right now - but otherwise have little to no business being words that you'd find together) is easier to remember than "6Z%2YneNzk" but offers significant benefits over weaker, lazy passwords.

Of course, you should combine this with multi-factor authentication to provide extra protection, but for now, it's time we took a good look at what we're asking users to do with their passwords.