How does changing your password every 90 days increase security?

Question

Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability or attack that this is designed to counter, or are we just following the procedure because "it's the way it has always been done"?

It seems like changing my password would only make me more secure if someone is already in my account.

This question was IT Security Question of the Week.
Read the Jul 15, 2011 blog entry for more details or submit your own Question of the Week.

Answer 1

The reason password expiration policies exist, is to mitigate the problems that would occur if an attacker acquired the password hashes of your system and were to break them. These policies also help minimize some of the risk associated with losing older backups to an attacker.

For example, if an attacker were to break in and acquire your shadow password file, they could then start brute forcing the passwords without further accessing the system. Once they know your password, they can access the system and install whatever back doors they want unless you happen to have changed your password in the time between the attacker acquiring the shadow password file and when they are able to brute force the password hash. If the password hash algorithm is secure enough to hold off the attacker for 90 days, password expiration ensures that the attacker won't gain anything of further value from the shadow password file, with the exception of the already obtained list of user accounts.

While competent admins are going to secure the actual shadow password file, organizations as a whole tend to be more lax about backups, particularly older backups. Ideally, of course, everyone would be just as careful with the tape that has the backup from 6 months ago as they are with the production data. In reality, though, some older tapes inevitably get misplaced, misfiled, and otherwise lost in large organizations. Password expiration policies limit the damage that is done if an older backup is lost for the same reason that it mitigates the compromise of the password hashes from the live system. If you lose a 6 month old backup, you are encrypting the sensitive information and all the passwords have expired since the backup was taken, you probably haven't lost anything but the list of user accounts.

Answer 2

I have argued before that it doesn't improve anything. From that post:

Obviously the attacker does not know your password a priori, or the attack wouldn’t be brute-force; so the guess is independent of your password. You don’t know what the attacker has, hasn’t, or will next test—all you know is that the attacker will exhaust all possible guesses given enough time. So your password is independent of the guess distribution.

Your password, and the attacker’s guess at your password, are independent. The probability that the attacker’s next guess is correct is the same even if you change your password first. Password expiration policies cannot possibly mitigate brute-force attacks.

So why do we enforce password expiration policies? Actually, that’s a very good question. Let’s say an attacker does gain your password.

The window of opportunity to exploit this condition depends on the time for which the password is valid, right? Wrong: as soon as the attacker gains the password, he can install a back door, create another account or take other steps to ensure continued access. Changing the password post facto will defeat an attacker who isn’t thinking straight, but ultimately a more comprehensive response should be initiated.

So password expiration policies annoy our users, and don’t help anyone.

Answer 3

Before answering whether it does help or it does not help, it makes sense to look at specific scenarios. (That's often a good idea when dealing with security measurements.)

In what situations does a forced-password-change mitigate impact?

The attacker knows the password of a user but has no backdoor. He does not want to be discovered, so he does not change the password himself.

Let's see if this scenario is likely:

How might he have learned the password?

• The victim might have told him (e. g. a new intern who should start working before he gets his own account setup, another person who should level an account in an online game
• The attacker might have watched the keyboard
• The attacker might have had access to another password database in which the user used the same password
• A one time only login using a computer owned (prepared) by an attacker.

What might have prevented him from setting up a backdoor?

• The service in question may not provide a way for backdoors, for example an email inbox or common web applications
• The privileges of the user may not have sufficient permission to install a backdoor
• The attacker might miss the required knowledge (in the online game Stendhal most "hacks" are done by angry siblings who just want to destroy some toy)
• The attacker might not have turned evil yet. (e. g. an employee that will be fired next month but does not suspect anything at the moment).

Why not use forced password expire?

It can be very annoying to users causing them to just add a counter at the end. This might decrease the entropy of passwords. According to my experience it generates additional support costs because people forget their new password more often than usual. I guess that is caused by the change password prompt catching them off guard while they are busy thinking about something else.

To conclude

It is far from a cure-all and it has a negative impact on usability, but it does make sense to balance that against the likelihood and impact of scenarios similar to the one I described above.

Answer 4

There was a study by Microsoft concluding the password expiration policy does not increase the security in real life scenarios.

These articles were removed, but available on the Internet Archive:

• Please do not change your password
• Study: Frequent password changes are useless

Original: So Long, And No Thanks for the Externalities: The Rational Rejection of Security Advice by Users

Answer 5

We all have our opinions, but we should also be looking for actual research on the question. Besides the paper by Cormac Herley of Microsoft on website passwords noted in Suma's answer, there is a paper from ACM CCS 2010: "The Security of Modern Password Expiration: An Algorithmic Framework and Empirical Analysis" (pdf), written by Yinqian Zhang, Fabian Monrose and Michael Reiter. They analyzed a great dataset and did some good analysis on how effective password expiration policies really are. Their conclusion? Forcing users to change their password every six months isn't very useful:

at least 41% of passwords can be broken offline from previous passwords for the same accounts in a matter of seconds, and five online password guesses in expectation suffices to break 17% of accounts.

....our evidence suggests it may be appropriate to do away with password expiration altogether, perhaps as a concession while requiring users to invest the effort to select a significantly stronger password than they would otherwise (e.g., a much longer passphrase). ....

In the longer term, we believe our study supports the conclusion that simple password-based authentication should be abandoned outright

For research on how to help users choose stronger passwords, see Recommended policy on password complexity - IT Security

Answer 6

The only two good reasons I have heard:

1. Window of opportunity - in an on-line attack scenario say you lockout the account for 30 minutes after 10 incorrect attempts (the Microsoft recommended setting for high security environments). Without any password expiry there is potentially an unlimited time window to attempt dictionary, brute-force, common passwords attack methods. Password expiry caps that. In an off-line scenario, where you do not realize your passwords have been stolen, again expiring passwords provides the attacker limited window of time to crack the passwords before they become useless. Of course as @graham-lee states you need other controls in place to detect things like a back-door

2. Compliance - virtually every regulator and auditor will look for password expiry. Including PCI-DSS, HIPAA, SOX, Basel II, etc. Correctly or incorrectly this is the world we live in. In addition the "no one got fired for buying IBM theory". If you do not have password expiry and others in your industry do, if you get hacked, then you were not following "industry standard practices". More importantly senior management cannot say this to the press, to a regulator, to a court. Same reason for having state-full inspection firewalls, anti-virus, IDS even though they are less effective now than 10 years ago.

That said as everyone has said password change is terrible for user experience, especially where there is no or limited single sign-on it can lead to "password change day" where a user goes through and changes the password for their 30 systems to the same one usually by incrementing a digit. This is clearly not desired behavior. My recommendation for changing this culture if it is possible in your regulatory / audit environment is to change your policy to remove password expiry with a clear justification (plenty here). Get this approved by the appropriate security governance and reviewed by audit / regulator. Then go ahead and change the systems. Alternatively use more single sign-on and federated ID, ideally with two factor, so that at least users only need to change one or a few passwords.

Answer 7

One reason not mentioned here, is that it prevents people who use the same password for everything from getting your system compromised if their password is figured out somewhere else. After a few passwords expire, users will start to have to come up with original passwords, which means when their favourite password is stolen and all their emails, social networking sites, and personal accounts get hacked, your system will still be secure.

Answer 8

How much will an expiration of passwords improve security?

This image shows, for some scenarios, the relation between time and the probability, that a brute force attack on a type of password succeeded, depending on the regular change of the password. The absolute timespan is of minor interest. How long it is - either there is not much difference, or the vulnerability is already pretty high.

As mentioned from others before, there are different scenarios, where changing the password might help:

• a) User A tells a coworker B his password in a special situation. Later B is fired. He now might think about misusing the password of A (his own account is deleted, we assume), but it could need some time (losing a dispute against the company in court, for example) before starting his attack. Here, it is very useful, to change the password - but of course not from secret2010 to secret2011.
• b) Attacker has access to the shadow file, and is brute forcing with certain amount of CPU-power (or GPU).

In the case b), the policy to change the password, looks reasonable, but you do only profit, if the risk to be vulnerable is already really high. Let me explain it with numbers:

Assume an attacker might try 250 000 passwords per second. Assume you say the password expires after 183 days, (about 6 months). The password is generated from a-zA-Z0-9 which is 62 signs. Assume the password is 8 signs long. Check how probable is a breakin after 10 year, which is 20 change intervals.

I've written a program, to test different parameters; call the program with

java PasswordCrackProb 8 62 250000 s 183 20

len             = 8
signs           = 62
attacks per day = 21 600 000 000
change after days= 183
intervals       = 20    days = 3660 years = 10
M               = 218 340 105 584 896
attacks         = 79 056 000 000 000
p(cracked)      = 0,3620773 without change
p(cracked)      = 0,3060774 with change

The result means, that it is cracked with 36% chance if the password wasn't changed, and with 31% if it was changed (but the attacker has a fresh shadow file). The difference is significant, and more so, if we take a longer time, 40 intervals, like 20 years:

p(cracked)      = 0,7241546 without change
p(cracked)      = 0,5184715 with change

but while 52% is much lower than 72%, 52% might not be acceptable.
But if we look at smaller intervals, the relative difference between changed and unchanged passwords gets smaller and smaller.

p(cracked)      = 0,0905193 without change
p(cracked)      = 0,0873006 with change

If you assume more CPU power or weaker passwords, the crack time gets smaller, of course, but the number of attacks per day is not very interesting. We have to assume: We can not enforce the user to change the password on a daily basis. So some days - maybe a week - is the minimum. And we don't need a maximum for longer than 20 years. Systems change, people change jobs. You cannot avoid to change the password after 20 years.

If the attacker has too much power, and brute forces the whole namespace in a single day, a weekly change won't help you much - he always wins. And if the attacker can only brute force 1% of the namespace (for a given password length) in 50 years, it doesn't help as well, to change the password - you will (nearly) always win.

Only in an intermediate, balanced scenario, the password change could make a difference, but do you really know, whether the bad guy needs 1, 10 or 100 years to brute force your password?

But keep in mind: If the attacker only once had access to your shadow file, which is now expired, the comparison from my program doesn't fit.

Answer 9

Simple answer - these days it almost never helps. Previous answers give the main two scenarios where it will, but even then, 90 days is still not that useful.

It could be worse - we spent ages persuading people that 30 days was too short but back in the day when stealing the SAM was relatively easy folks were very worried about a brute force attack on the SAM. We got many companies to agree on a compromise of 90 days but although cracking power has definitely gone up, hashes are better protected and generally most places now have at least some password complexity rules in place so it has become far less important.

Answer 10

I would just like to add one thing. We can approach to this problem from social angle. By reseting password every X days we are telling the user - Hey, this is important and it should not be taken lightly!

Answer 11

As one of the new things in the new NIST publication, called Special Publication 800-63-3:

No more expiration without reason. [...] If we want users to comply and choose long, hard-to-guess passwords, we shouldn’t make them change those passwords unnecessarily.

From: https://nakedsecurity.sophos.com/2016/08/18/nists-new-password-rules-what-you-need-to-know/

The publication from NIST itself can be found here: https://github.com/usnistgov/800-63-3

It has some other recommendations that the infosec world has long accepted: 8 characters minimum, a maximum length of 64 characters or longer, no password hints or secret questions, allow all characters (including emoji), and no annoying rules like "must contain a special character but not a dollar or percent sign".

Answer 12

Most online services (e.g. Banks) limit the number of online attempts per time unit, rendering a brute force attack futile.

The result of a password-change policy is almost always a security risk. It can take the form of a PostIt password, or passwords that take the form pass!1000, changed to pass!1001, then to pass!1002 and so on.

Answer 13

A major consideration to take into account when questioning this is that you may not know your account has already been breached.

If your password had become compromised, and you were aware of it, you would obviously move immediately to change it in any case.

By forcing you to change your password every 90 days (or face account suspension) administrators are mitigating two risks. 1. That inactive users/accounts will be available for unlimited amounts of time for an attacker to try and brute-force their way into. 2. That, in the event you do not you've been breached, you are forced to change your password regardless (thus re'locking' the attacker out of your account)

Answer 14

It might seem somehow better in sense that the institution is enforcing to change passwords at some periodic interval. However, if the user is changing the passwords in the interval, but is always leaving a patter behind his changes, then it makes no sense of changing the passwords. Its more serious threat instead. The user feels he/she has changed his/her last passwords and feels safe. and the attacker is always getting a clue to the password.

-

The best way is always to suggest the service provider to implement a better and safer algorithm then asking for its end users to reset the goddamn password every time. If someone is same enough he/she will have in mind that these days we have Single Sign On, and OpenID, where people prefer to login with one accounts rather than remembering different passwords for different websites.

- Despite of all the discussions, its recommended to change your password frequently, But,

On YOUR FREE WILL

A Quick Tip : Use multiple words in your password (The safest marked till date).

Answer 15

To add to what has already been said, I can think of 2 more reasons why changing passwords regularly is helpful:

1) When computational power raises substantially

Say, in early 90s 7-char passwords were considered secure because computers weren't nearly powerful enough to bruteforce them.

24 years later systems which still have the same password can be successfully bruteforced.

Some calculations, considering the password consists of 24 letters (uppercase and lowercase), 10 numbers and 10 symbols, and Moore's law (x2 more power every 2 years):

possible combinations = (24 + 24 + 10 + 10) ^ 7 = 6,722,988,818,432

tries per second in 1990 = 100,000 (for example)

time required in 1990 = possible combinations / tries per second = 2 years

tries per second in 2014 = tries per second in 1990 * (2 ^ 12) = 409,600,000

time required in 2014 = possible combinations / tries per second = 4 hours

This is more about increasing minimum required password length, but it should be done regularly and short passwords should be changed.

2) Compliance with ISO/IEC 27001/27002 standards

From ISO/IEC 27002:2013, section 9.4.3:

A password management system should:

...

e) enforce regular password changes and as needed;

3) Compliance with PCI DSS standard

From PCI DSS v3, section 8.2.4:

8.2.4 Change user passwords/passphrases at least every 90 days.

8.2.4.a For a sample of system components, inspect system configuration settings to verify that user password parameters are set to require users to change passwords at least every 90 days.

8.2.4.b Additional testing procedure for service providers: Review internal processes and customer/user documentation to verify that:

• Non-consumer user passwords are required to change periodically; and

• Non-consumer users are given guidance as to when, and under what circumstances, passwords must change.

Passwords/phrases that are valid for a long time without a change provide malicious individuals with more time to work on breaking the password/phrase.

Answer 16

We rotate 'public passwords' (guest wifi) to flush out access of employee's who have since left the company.

We accept the burdens of rotating 'individual passwords', because a) we always start with the assumption that every non-techie's accounts have already been hacked. And b) to 'automatically close' all accounts which have been forgotten. Since the 'centralized set new password' access is the only one we never forget to close. (fail-safe expiry of all single sign-on dependencies) This also includes hardware (notebooks) that are handed to a new owner, and might have 'saved passwords'.

(c) Plus, it makes people stay aware of where their passwords are auto-saved.)

(d) Plus, we can tell people to 'please change all your passwords', after a questionable data-loss. That only works reliably with employees who have been trained at password-changing.)

In short, automatic expiry is a safe-guard against people not behaving as you asked them to do.

Answer 17

A strict literal reading of the question leads to the answer: It increase security in a negative way: either through post-it notes or using increasing numbers or shift-number.

It might decrease the risk of legal issues from compliance, however.

Answer 18

Many answers already indicate that often forcing users to change their passwords isn't useful; I would like to add the opinion of Bruce Schneier, probably the most famous security expert.

Basically he says that it depends on what that password is protecting, and how a stolen password can be used. This sounds obvious, but it is not obvious at all that between the password for Facebook and the one for your online banking, it would be better to change the former. That's right: it makes more sense to change your Facebook password rather than your bank's password. Let's see why.

Regularly changing your password helps in case someone has found it and you are still unaware of it, because the attacker prefers to be stealthy. Depending on the account they have violated, that may, or may not, make sense.

• In many cases, if the attacker discovers your password, he'll do something that you will surely notice. For example, if he can access your bank account, he'll transfer money out of it. Quoting Bruce: "In this case, it doesn't make a lot of sense to change your password regularly -- but it's vital to change it immediately after the fraud occurs." The idea is that if no one is stealing money from your account, it most likely means no one has found your password (why would they wait, otherwise?), so there's no reason to change it.

• Instead, someone who steals your Facebook password might use it to spy on you. For example, your wife might use it to check whether you have a lover. In this case you are not going to notice the attack, because the attacker wants to be able to continue spying on you, so they are not going to post new messages or anything that would be noticeable. Here, regularly changing your password would prevent her from continuing.

So, given the different attack scenarios, changing your Facebook password is more useful than changing your bank's password. It is quite counter-intuitive, but it makes sense.

Answer 19

When your users are humans, it doesn't necessarily increase security.
See the FTC post "Time to rethink mandatory password changes" by Chief Technologist Lorrie Cranor, based on research about how humans actually use these systems. (Washington Post coverage here.)

Also, as discussed in the SANS security blog, "One of the key guidelines of changing behavior is [to] focus on the fewest behaviors that address the greatest risk." The costs of requiring the password changes are better spent on teaching users to use strong, unique passwords and/or password managers/multifactor authentication. Additionally, the benefits of password changes have declined now that attacks can and often do happen much more quickly than the long, slow, manual attacks that password changes could help cut off.

Answer 20

I personally don't think that enforcing password expiration on office users (or, people hardly familiar with computer use, let alone cyber security) is a good idea in the form as it is done in many organizations. As it was noted above, the major security flaw in this case is that those same office users simply write their passwords on sticky notes and paste them to their screens or stick them in their desks. Or, if the person is slightly more "advanced", they may start using passwords such as letmeinMONTHYEAR.

Nonetheless, periodic password expiration is a good thing, once it's coupled with the proper password management. Obviously most (non-savant) people will not be able to remember really secure passwords -- something like v^i77u*UNoMTYPGAm$. So what shall we do?

I personally use a password manager that tracks all of my passwords, except one, the master password. This really simplifies things and makes them way more secure (provided my master password is secure itself and I can easily recount it to log in to the password manager.) There're several commercial password managers, which I will let you discover and test for yourselves. I personally use Lastpass which is free for general use and is secure. It is available via the web browser and can be also installed as an app on your smartphone or tablet. As for security concerns of letting a third-party solution manage all of your passwords, I rely on the vetting done by Steve Gibson. You can watch the full version of it here.

Answer 21

Lost, misplaced or stolen hardware can also be an attack vector providing access to at best obfuscated passwords.

Attacker can steal a smartphone and recover passwords to WiFi -- in most places the general user account.

Answer 22

I would tend to agree that this is primarily a compliance-driven requirement with at best a marginal net increase in security (at, unfortunately, a substantial cost in loss of operational availability, due to otherwise legitimate users being locked out after 90 days, machine-to-machine communications failing because their passwords expired and nobody updated them, calls to the Help Desk to resolve password reset problems and so on).

That having been said, there are valid reasons for enforcing such a policy (although -- these justifications are greatly lessened by the relatively lengthy validity period for a particular password... after all if a cyber-crook gets your password for 90 days, there is a lot of damage that he or she can do).

The biggest advantage comes in the following scenario :

1. You get hacked or otherwise compromised, and the cyber-crook finds out your username and password.

2. It happens to be near the "change threshold" time period (typically -- the end of the quarter, and don't think cyber-crooks don't know that).

3. You are required to change your "old" password (which both you and the cyber-crook, know).

4. You follow Company policy and change your password, meaning that now the cyber-crook is locked out again. He or she can try to use the same methods as before, to get unauthorized access to this credential as well...but doing so may be annoying and time-consuming.

The point here is, "changing one's password to something new", is not something that a cyber-criminal will normally do, because from his or her point of view (unless, of course, the password hijack is really a kind of Denial-of-Service attack), changing the password and locking the legitimate (original) owner out of the account, will immediately alert the legitimate user that something untoward, is going on.

This is on top of the fact that cyber-criminals usually hijack thousands of passwords at a time; changing all of these, particularly because they may not have access to the back-end systems set up to allow legitimate users to do this, can be an onerous task.

None of the above is written ignoring the fact that cyber-crooks will usually set up their own, privileged account, the moment that they get unauthorized access to your system, or is meant to ignore the other potential weaknesses in the "mandatory 90-day password change" paradigm that is so prevalent these days. Think of this rule as one (minor) element in your layered defense strategy, and you'll see that it has a place... but it's certainly not something that you should rely on, to keep the bad guys out.

Answer 23

If reasonably strong passwords are used it doesn't. Passwords might need to be changed regularly if they can eventually be cracked offline if an attacker has managed to extract hashes from the database. However, enforcing password changes seems a weak form of security when users should be encouraged to select strong passwords, for example based on long passphrases.

Without being educated on password security, most users will not choose strong passwords so the 90 days change limit is designed to protect these accounts. As these users do not understand or care about the security of their account, they are likely to choose another weak password possibly based on their old one (which means an attacker can crack the old one and then use variations of that in an online attack). Using the 90 day policy in combination of checking the similarity of the new password with the old one can be seen as helping. Other users' passwords will be more difficult to crack, although if enough time is dedicated by an attacker this is entirely possible - any password with a strength of under 128 bits of entropy means that it has the possibility of it being cracked eventually, although unless an attacker is specifically interested in a particular account, this has a very low probability of occuring.

A possibly good reason for changing passwords is that users will often save passwords in insecure places. For example, the browser autocomplete functionality may have remembered the password on a friend's computer. However, this is neither here nor there.

This is why it is seen as good practise to change them every so often. The 90 days caters for the lowest common denominator. Any users using strong passwords generated using a password generator will have minimal hassle for them to then change theirs so this policy should not cause significant problems. I can understand users with many accounts with this policy will be annoyed.

A further reason for changing your password often is that password storage algorithms such as bcrypt and other key derivation functions have an iteration count, that can be upped to increase the work factor as Moore's Law takes hold. Entering a new password gives opportunity for the password hash to be resaved with more iterations, or that the entire hashing algorithm be updated as the security posture of the system increases. For example, if the site was originally storing cleartext passwords, then migrated to SHA-1, then SHA-1 with salt, then eventually bcrypt, the act of changing the password often is used as an opportunity to update the stored format for this user within the database.

Note that a password change isn't technically required, just that many systems will rewrite the password to storage at this point, however they could also do this upon successful login because the cleartext password will also be available at this point. Forcing a password change will help in these instances, and also has the advantage that if there were any undiscovered password leakage vulnerabilities on the site (e.g. SQL injection) then the password will have been changed to something more secure as well as the hashing format being updated. Note that forcing a password change doesn't help update inactive accounts, which is why some standards dictate that inactive accounts are disabled after a period of time (e.g. PCI after 90 days) - if password is also stored in some format in the DB it is also recommended that this be blanked in case the user has reused it elsewhere and it is later leaked.