In a typical example of bad user behaviour, I don't think up a new password each time one expires, I simply rotate a few easy-to-remember ones. And that's another risk – because I have to remember several passwords, I keep my rotation simple and therefore easier to crack.
But am I wasting my time? A Microsoft researcher thinks so. In a report on computer security, Cormac Herley argues that much of the advice given to users about password security offers little benefit. He says:
"[Changing a password often] will help only if the attacker waits weeks before exploiting the password. So this amplifies the burden for little gain. Only if it is changed between the time of the compromise and the time of the attempted exploit does [this rule] help."
