passwords | Page 2 | General financial discussion | Discussion forum

Bill , the strength of the password and having unique password for each Login ID, are a more important factors than frequency of password changes ( unless you suspect they may have been compromised ).
There has been a rethinking in IT Security in forcing people to perform regular password changes because of the difficulty in making massive password changes..
i.e. they end of using weaker passwords

You always have the option to occasionally go back to a very old account and update an existing password with a stronger password ( Alfa, Numeric, Upper & Lower case, Special Characters). This technique is a lot more manageable.

regards,

Wayno

Top It Up said

JUST read the specs and a review - "In this post-Edward Snowden world, people are much more conscious about the security and privacy of their data than ever before."

No offence, dude ... but that is supreme overkill PLUS Truecrypt was shrouded in suspicion and disappeared overnight - who were those bandits?

https://www.cloudwards.net/news/truecrypts-unexpect-closure-leaves-users-confused-3775/  

Top It Up, everybody knows about that article and nothing new here ... There are replacements for Trucrypt out there but I'm still using it b/c I like it. YES, there could be security holes there since it is not maintained anymore, but I haven't found a better solution yet. BTW, do you have a better approach ?

Bill said
Thanks all, I appreciate the input. But my only question is about how often I should change my password. I've got some that I've used forever, some that I've changed every year or so, …

Changing one's password regularly reduces the window for someone else to discover and use the password. That can be done by

1. capturing it unencrypted from you or your computer,
2. capturing it encrypted as it travels across the Internet and cracking the encryption, or
3. swiping a copy of, or a backup of, the password database from the financial institution's computers and cracking its encryption or hashing.

If one changes passwords yearly, then someone needs to do one of the above within the last year to compromise the passwords. #1 is possible. #2 and #3 are not likely within the last year.

I would change the passwords that are as old as those Canada Trust Johnny Cash ATM's! Those ATM's were decades ago.

Encryption algorithms, like 56-bit DES, used back then are now vulnerable to brute force attack using our faster computers today. #2 would be possible if someone had recorded your Internet traffic back then. #3 would be possible if someone now got a hold of old backup tapes or used computer drives from the financial institution.

Top It Up said
Potent LastPass exploit underscores the dark side of password managers

Developers are scrambling to fix flaw that allows theft, malicious code execution.

https://arstechnica.com/information-technology/2017/03/potent-lastpass-exploit-underscores-the-dark-side-of-password-managers/

Every month we find articles like this one. However, in general, they are sensationalist. Password-managers will face flaws as any other system. However, they are the best solution so far, because they fix these problems in a matter of days. Also, they are the first to alert the entire community to change the master password if there is any suspicion that the database was compromised (different from other companies such as Yahoo, Equifax, Uber, etc).

If you are concerned about these flaws, just have 2-factor authentification or/and a flash drive as an extra key. This way you added another barrier to the hacker.

There is no perfect system against hackers. However, Password Manager + 2-Factor Authentification + General security best practices will protect you against 99% of problems.

If you want to organize your financial privacy, here is a relevant interview with a specialist:
https://radicalpersonalfinance.com/461-how-to-protect-your-financial-privacy-and-keep-your-accounts-secure-interview-with-justin-carroll-from-the-complete-privacy-and-security-podcast/

Top It Up said
...For the record, I use the same 4-digit code I was given with my first ATM card almost 40 years ago. In fact I like it so much I use it for my home security code, my 2 credit cards, on my smartphone, on my tablet, even the keyless entry at the cabin (the entry requires a minimum 8-digit code so I enter it twice) ... talk about 4-digits that are hardwired in the brain - it's a beauty.  

I find it very surprising that you would reuse the same password..

Top It Up said
After reading this silliness, I'll pass on this so-called specialist -
For the record, I use the same 4-digit code I was given with my first ATM card almost 40 years ago.

After reading your comments on the thread, I see that you are a resistant person moved by inertia. There is nothing we can do in this case. Good luck.

I have something like 100 online sites that I need user names and passwords for. It simply makes no sense to have 100 different passwords, so I use a Password Manager (generator) for many of them, and then half a dozen personally selected passwords I can remember for those sites which won't accept the 'setting' of a password by a Password Manager.

FWIW, it is length of password that matters more than the combination of characters.....provided one does not use well known phrases and things like ABC123 for their passwords.

Many sites will lock one out if there is more than 3 attempts and/or will ask security questions. I also never access sensitive sites in a public place or unsecured WiFi so I simply don't worry about repetitive use of passwords across sites. That is good enough for me.