Invisible world

Study: Frequent password changes are useless

 
文章内容
[ 2010-04-16 09:37:32 | By: grinder ]
 
Study: Frequent password changes are useless
By Christopher Null
.Users hate them. They're a massive headache to network administrators. But IT departments often mandate them nonetheless: regularly scheduled password changes — part of a policy intended to increase computer security.

Now new research proves what you've probably suspected ever since your first pop-up announcing that your password has expired and you need to create a new one. This presumed security measure is little more than a big waste of time, the Boston Globe reports.

Microsoft undertook the study to gauge how effectively frequent password changes thwart cyberattacks, and found that the advice generally doesn't make much sense, since, as the study notes, someone who obtains your password will use it immediately, not sit on it for weeks until you have a chance to change it. "That’s about as likely as a crook lifting a house key and then waiting until the lock is changed before sticking it in the door," the Globe says.

On the bright side, changing your password isn't harmful, either, unless you use overly short or obvious passwords or you're sloppy about how you remember them. Many users forced to change their password too frequently resort to writing them on sticky notes attached to their monitor, about the worst possible computer security behavior you can undertake.

Frequent password changes are simply a waste of time and, therefore, money. According to the Microsoft researcher's very rough calculations: To be economically justifiable, each minute per day that computer users spend on changing passwords (or on any security measure) should yield $16 billion in annual savings from averted harm. No one can cite a real statistic on password changes' averted losses, but few would estimate it's anywhere approaching $16 billion a year.

Bottom line, IT departments: Drop the password-change mandates. You're only creating extra work for yourselves and making the rest of us hate you.

— Christopher Null is a technology writer for Yahoo! News.
 
 
QR Code
请用微信 扫一扫 扫描上面的二维码,然后点击页面右上角的 ... 图标,然后点击 发送给朋友分享到朋友圈,谢谢!
分享:
分享到微信

文章评论

nessus
无题
说的太好了,我要把这个转发给我们IT部门。劳民伤财的。

2010-04-16 10:02:36 | 引用

发表评论

加西网为北美中文网传媒集团旗下网站