Every password management article I’ve read advises you to change your password(s) regularly. Why? The only scenario I can see where this is of any value is one in which your password(s) have been exposed. Absent exposure, if you’re using strong, complex passwords, the only way they’ll become compromised is via a determined and successful decryption attack, which, using generally available technology, could take eons. If the attacker is in the middle of a long run, the next password to try could well be your current password, but if you change it, you can’t be sure that a subsequent try won’t be your new, changed password. And if you’ve got a LOT of strong, complex passwords, changing them all could take days. In fact, I have password-protected accounts on some sites where there is no obvious way to change a password or to delete the account altogether. Seems like the cost/benefit ratio here is unreasonably high.
But if I had had a password-protected Target account recently, I would certainly change that password, but that wouldn’t encourage me to change all my other passwords.
I do worry about my Roboform master password being compromised, thus exposing my 800+ strong, complex, managed passwords. But it’s fairly easy to keep track of that password and change IT if there’s any hint of it having been exposed. But just changing it now and then, while practical, seems of little value.
What am I missing here?
