"Have often should you change your TMP password?" Topic

Do you still use the TMP password issued to you by Bill …and just for my records, what is it?

I thought I created my own when I joined.

In the old days, you set your original password. This caused problems when people managed not to set a password on their account…

In more recent years, the system assigns you a password, which you can always change.

I'm still using my original password.
It's "n0tYour1nf0", without the quotes. Please update your records.

I change passwords on sites where the potential damage can be high. If someone gets my password here, they can change my preferences and that's about it. Oh, wait, they could put me on the Napoleonic boards! <shudder>

I've never changed mine since the initial sign-up.

I haven't changed mine either. I can't see the potential damages as being at all significant if someone had it.

Tom

Have not changed it – No. 3 son, who is a tech wizard, tells me that frequent password changes, especially if mandated, actually degrades and not enhances security

Yes still the original, if its that hard to remember it for me who else is going to get it?

Your No. 3 son is correct. Frequent changes means people will start writing them down, or use passwords that are easy to remember, like "password". Oh I have to change it, great, "password1" it is.

NEVER

Never changed my original. Even Microsoft has finally admitted changing passwords frequently is meaningless. Using strong hard to guess passwords is better. That said, I don't use the same password for my gaming boards as my finances.

I haven't changed ANY passwords for at least 10 years unless I'm forced to, my previous employer required monthly changes with no repeats!!!
My original password was assigned by Hotmail and it was so random that I felt it was as secure as it's likely to get.

TMP has a password?

Still use my original password, no plans to change it.

I think a 12 character minimum that allows unicode is a good start. A dictionary of common passwords (top 1000) is also good to implement. Rotation isn't really necessary.

Also, store the passwords hashed (PBKDF2) with good salt and pepper.

And allow password managers, I cannot remember }ȹƧ♡⚕😽♺😀♈ı☺ìŅƩ«ǭ😕Ę+*¸Ə☒Ťš> or whatever.

That said, does it matter? TMP uses SHA1 and an invalid certificate.

NO …

Telling people how often your change your password is a bad idea. Anything people know about your password can help crack it, and cracking one can lead to cracking others. So it's probably not smart to even *ask* how often people change their passwords.

TMP is awesome, I'm here every day, but as an affectionate critique I have to say it is *extremely* insecure. It appears to me, an amateur, that when you log in your password is sent in clear text. As a result, it is essential that you change your password daily, or ideally every time you log in. If anyone asks that's what I do.

"TMP is awesome, I'm here every day, but as an affectionate critique I have to say it is *extremely* insecure."

That's true. It keeps sending me emails asking if I really like it. :-)

My PW hasn't changed since I created it.