Changing your password every three months makes you predictable

Your bank copied his manual, but Bill Burr recanted in 2017. In 2003, in the NIST standard, he had written that passwords needed uppercase, numbers and symbols and had to change every three months. “Much of what I did I regret,” he told the Wall Street Journal fourteen years later.

The problem wasn’t his idea; it was yours. When they force you to add a symbol, you put “!” at the end. When they force you to change every three months, you write “Summer2024!”, then “Autumn2024!”, then “Winter2024!”. In 2010, Weir and his colleagues processed thirty-two million stolen passwords: fewer than 4 % were truly unpredictable.

The 2017 version, still in force, changed three things. Your bank shouldn’t force you to change the password without signs of theft. Nor to mix symbols. It should reject the ones that show up in leaked lists.

What you can do without waiting: pick a random four-word phrase. “Apple donkey red bridge” costs an attacker 550 years today, according to the NIST’s standard calculation. Adding a symbol at the end buys them half an hour more.