Shortly after Carnegie Mellon University professor Lorrie Cranor became chief technologist at the Federal Trade Commission in January, she was surprised by an official agency tweet that echoed some oft-repeated security advice. It read: “Encourage your loved ones to change passwords often, making them long, strong, and unique.” Cranor wasted no time challenging it.
The reasoning behind the advice is that an organization’s network may have attackers inside who have yet to be discovered. Frequent password changes lock them out. But to a university professor who focuses on security, Cranor found the advice problematic for a couple of reasons.
