Good luck remembering them all, also change them all every 30 days, so here are my secrets.
Password expiry hasn’t been considered best practice for a long time (must be at least a decade now?) largely because of the other points you mentioned; it leads to weak easily memorable passwords written somewhere easily accessible. Even when it was considered good 30 days would have been an unusually short time.
Current advice is to change passwords whenever there’s a chance it’s been compromised, not on a schedule.
well, the only solution for that is to use a password generator based on length and complexity. I have used it once and am considering using it for all my accounts with each its own password. I live in a safe place so having them written down is not really an issue.
For absolutely best security, you would change your password to a new, extremely long, randomly generated character string every time you logged in. What the best security options are, and what users are willing/able to put up with has a very small, if any overlap.
As for writing them down, my advice is to obfuscate them. Apply your own secret code to the password, hide it in a poem, get creative. Once an attacker is at your desk, they pretty much own your shit. At that level, the only thing your password is providing is privacy, not security.
Your security is only as good as the weakest link, which is usually people. If your password policy encourages users to stick a note to their screen then your weakest link is anyone in the office deciding to take a selfie or joining a call with their camera on. Best practices balance security with what users are actually willing to do.
Password expiry hasn’t been considered best practice for a long time (must be at least a decade now?) largely because of the other points you mentioned; it leads to weak easily memorable passwords written somewhere easily accessible. Even when it was considered good 30 days would have been an unusually short time.
Current advice is to change passwords whenever there’s a chance it’s been compromised, not on a schedule.
well, the only solution for that is to use a password generator based on length and complexity. I have used it once and am considering using it for all my accounts with each its own password. I live in a safe place so having them written down is not really an issue.
For absolutely best security, you would change your password to a new, extremely long, randomly generated character string every time you logged in. What the best security options are, and what users are willing/able to put up with has a very small, if any overlap.
As for writing them down, my advice is to obfuscate them. Apply your own secret code to the password, hide it in a poem, get creative. Once an attacker is at your desk, they pretty much own your shit. At that level, the only thing your password is providing is privacy, not security.
Your security is only as good as the weakest link, which is usually people. If your password policy encourages users to stick a note to their screen then your weakest link is anyone in the office deciding to take a selfie or joining a call with their camera on. Best practices balance security with what users are actually willing to do.