Sign in. It’s quick, free and it’s up to you.
An account is an optional way to support the work we do. Find out more.
The Daily PollTHE PRIVATE PERSONAL information belonging to potentially tens of thousands of Irish people could be sold on the darkweb to the highest bidder unless some form of deal is brokered with the hackers, senior sources have warned as the massive HSE cyberattack enters its fifth day.
The HSE has been left reeling by what has been described as the “biggest ever cyber attack” in State history.
The ongoing fallout of the cyber attack has placed a renewed focus on the security of people’s data online. Many people have been hacked online – whether they realise it or not.
People are consistently warned to make sure their passwords are difficult to guess or to change them regularly, or to use an authenticator system. However, not everyone acts on this advice.
We want to know: How often do you change your online passwords?
To embed this post, copy the code below on your site
I tried changing my password to something more complex, but it said it was too weak.
I tried putting in “Chuck Norris” and it said my password was too strong.
@Dan Skelton: when chuck norris smokes, the cigarette gets cancer
@Dan Skelton: Chuck Norris can connect 4 in 3 moves
@Richard Cronin: A gun sleeps with Chuck Norris under it’s pillow!
@Dan Skelton: Chuck Morris once strangled someone with a cordless phone
@Dan Skelton: Chuck Norris can kill two stones with one bird
@Dan Skelton: Chuck Norris does not own a stove, oven, or microwave , because revenge is a dish best served cold.
@Dan Skelton: Jesus walked on water, Chuck Norris walked on Jesus!
@Dan Skelton: Who’s Chuck Norris?
@Dan Skelton: When Chuck Norris was born, the only person who cried was the Doctor. Never slap Chuck Norris.
@Dan Skelton: chuck Norris can swim through land.
Changing passwords frequently is not good security policy.
When people change them frequently, they recycle passwords with minor variations, or just use weaker passwords altogether.
Second factor authentication is many many times more valuable.
@Gerard: Yes, two factor authentication, where possible works well, I use it. I also have an encrypted USB drive, with a password phrase, holding a list of all my passwords. It’s not stored on a device and if I did somehow lose it, which is unlikely, it’d take an NSA level attacker to gain access. Oh and, just in case, I keep a backup.
@Arch Angel: what do you have that’s worth all that hassle? Secret recipe to the best ham sandwich ever?
@This time its personable!: It’s not that I have the secret to the universe but rather these days I’ve a lot of passwords to remember and this is the most secure way of doing that. I’ve had my credit cards compromised a few times over the years and can honestly say it wasn’t because of leaving passwords lying around.
@Arch Angel: it’s a rather worrying and shiddy experience to be fair, at least it was credit cards I guess so you weren’t totally stung, I hope, other than the hassle. Of course, once you unleash the recipe for the sandwich you’ll be quids in eh!
@This time its personable!: I’ll give you my sandwich recipe, for a modest fee of course. My grandkids swear by it, at least I think that’s what they’re swearing at. I could be wrong.
@Gerard: thats not quite true Gerard – the reason people are advised to change passwords frequently is because in many cases hackers have already accessed a system and nobody is aware…they can repeatedly access the system and lurk with intent – hence it is commonly suggested that people should update /change a password this is actually good security policy – ( frequently can mean months though not every week )
You might want to consider the wisdom of posting on a website that you never change your password
I keep forgetting mine because I have so many, I end up changing them nearly every time I log in…
@Serge the llama: Me too… the should have had an option…. “change password daily ”
@Serge the llama: me too lol
I use a password manager (1Password) so each password is unique and just a bunch of gibberish. It’s the best solution since if one password is compromised it can’t be used to get into anything else. I’d highly recommend it.
@Penny: It’s definitely the best solution. I’m not a network expert, but would know enough that I’d get called on by neighbours and friends to sort out minor issues. I know 2 people with the same WiFi password, 1 – 10, and one of these uses that same password for some online accounts. Another one uses a-b-c-d-e-f-g. When I need the WiFi password to sign in from my phone I’d usually ask, but in cases where there’s a forgotten password I have an app that can get most passwords in about a minute and a few minutes for better passwords. If people really want to use simple passwords, such as the a-b-c….then at least stick a capital letter in there somewhere. Still not ideal, but exponentially harder to hack.
@Penny: and if 1Password is compromised then all your accounts are too
@Tommy Roche: where were you and what were you at last Thursday night early hours Friday morning Tommy?
@Mickety Dee: There’s no chance of that if you’ve setup 2fa for your password manager. Having different complicated passwords for each login stored in a password manager with 2fa is the only secure way to handle passwords. Some passwords managers will also inform you if your login details have been compromised.
@Mickety Dee: Then use KeePass if you’re that concerned. You can store the database in the cloud knowing only you have the encryption key, so if the cloud provider is compromised your database is still secure but you can access the database from all of your devices.
Password Manager is better than no password Manager. For most people, hosted solutions like 1Password or LastPass are a sufficient level of protection while maintaining accessibility. For those who are so concerned about the security they want to sacrifice accessibility, they can go the route described above.
@Penny: There are a few that are really helpful. Saving passwords to your browser should always be a big no-no.
@Tommy Roche: true – another top tip is to add a character like % or & this also makes any password hack infinitely more difficult and but can be easy to remember
@Mickety Dee: The vault of my 1Password is on a cloud service (not at 1Password HQ) and is encrypted with a decent password that means something to me, but would take over 10,000 years to crack. It contains 403 items, which I can autofill on the relevant login page on any browser across my three devices. All the passwords are unique (randomly-generated example: xR72icFpzt9MZ@-PMB8Xo) and use 2 factor authentication where supported. 1Password also autofills forms with my name, DOB, addresses, etc when required, making form-filling a single-click operation. A password manager can change your online life!
If your password(s) is good enough, you shouldn’t need to keep changing it ….
@Martin Galvin: That’s not how it works.
@Ajax Penumbra: I’m not interested in how it works …. If your passwords are solid, and you don’t type them into any bogus links promising €9M from a Nigerian prince, they’re safe …..
@Martin Galvin: So what happens when there’s a security breach on a website that you use and your username and password data is stolen? Let’s say that the website doesn’t use two-factor authentication and the password is the only form of validation.
If you never change that password, that info will always be valid for that website and also any other sites you use the same username and password for.
@Ajax Penumbra: change your password if compromised I suppose.
@Ajax Penumbra: “other sites you use the same username and password for”??? That’s your problem right there.
@Tomás Barrett: but you don’t always know you’re compromised until it’s too late. Better to be safe than sorry, no?
@Col de Gal: Indeed it is! So many people recycle the same passwords or simplistic variations thereof. Very poor security practice.
@Martin Galvin: i admire your confidence…..most of the really smart cyber sec people I know recommend you update your passwords every couple of months no matter how ‘good’ you think the password is – there are numerous reasons why changing is ‘best practice ‘ – two step and multi verify etc etc are all better but people should defo not get complacent in keeping same passwords for a long period – that is a very bad idea
@Dave Hammond:
good link for seeing if you have been compromised
The old advice to change passwords regularly has changed. Making sure your original password is strong is the new advice: https://arstechnica.com/information-technology/2019/06/microsoft-says-mandatory-password-changing-is-ancient-and-obsolete/
@Contrary Mary: That’s good until your password is leaked in a hack.
You can check to see if for email address or password has been leaked using this site.
https://haveibeenpwned.com/
I’ve noticed that a few of my old strong passwords are mentioned in this list.
@John Murphy: will it not just say you’ve been compromised so you’ll panic and pay for the service?
@John Murphy: are they not just saying you’ve been compromised so you’ll panic and pay for their service?
@Anna Carr: no its just a site that searches publicly available lists of hacked email addresses and passwords.
I used it after my twitter account was hacked.
Then I could see what password the attacker was using.
I changed all my passwords after that hack and used a password manager like dashlanes or lastpass.
@John Murphy: Well, yes, that’s the general idea, but a strong password is still the best option. Changing it could also make it easier to hack than an original strong password. I’m aware of that site and a few others. Thanks for thinking of me. :)
So this should really ask.. does the website you are on force you to use 2FA using google authenticator, Microsoft’s equivalent or authy…
I use the app LastPass – it will generate very strong passwords for you and store them.
This graph shows why it’s important to use a mixture of upper and lower case, numbers and symbols.
https://cloudnine.com/wp-content/uploads/2020/02/CrackPassword2.png
@Jim Buckley Barrett: unfortunately they changed their free version to only allow you to login from on device. which restricts a bit.
It’s misguided to believe that you alone have access by using a password or some other form of authentication. The person/s or organisation that wrote and control the program/app can at any time access your info.
As an example; You forgot your login password and request a password reset.
How do you think that’s done?
pRiVAte
It’s also important to close old accounts or delete/unsubscribe from services you no longer use. Older or defunct services etc are considerably more likely to be compromised. If you reuse the same passwords you’re gonna end up on a list. If you have a Google account you can use it to do a password check up.
This is hilarious another data gathering poll to let criminals get the stats nice one.
Someone can be that naïve believing a payment would resolve the matter.
Pay once and you have to keep paying all your life. And then the trust thing of these people, sure we can trust when they say it has not be sold already.
We move to e.signature like any developed country and of course, to more subcontracting vital and essential services to USA and UK corporations …see what has happening
I don’t care. Shocking thing to say in 2021 ! … The “he doesn’t care police” will be knocking soon…
We should all use the trust system. Everyone just use “password” as their password for everything. Sure it will be grand.
@jkcdub: I use 1234567CM as my password for everything.
People should not answer this poll, and The Journal should know better than to ask it.
@Kevin Farrell: soooooooo serious …. lol
@Terry Cahill: Sooooooooo clueless …. lol
I use my thumbprint for most important things!
@Caroline Broadhurst: Not as save as you might think – https://www.bbc.com/news/technology-30623611
@Jim Buckley Barrett: *safe – TheJournal.ie you need an edit feature!
I keep forgetting them so I have to keep changing them lol
Himm,
Best password to use is .. incorrect
If I forget it the system will always remind me .. Your password is incorrect
Strange thing, here in USA banks do NOT force customers to reset Pw at a cadence. The response I heard was ‘it would cause too many phone calls to reset it’. One I have has not been changed in 20 years .. unbelievable!
@Roland Kelly: NIST guidance, which is widely followed in the US, in the past few years has been not to enforce regular password changes or even use password complexity. Instead it recommends a long (16 character) password coupled with MFA/2FA
You should not be changing passwords regularly as it encourages bad behaviour such as reusing passwords or using easily guessed ones.
2FA / MFA is an absolute must and where not available at a minimum you should be using a password manager.
Rules/Policies are there and can be broken. people lives are at risk.
Every couple of years , answer options are a bit limited..
have your say