Cybersecurity expert: Frequent password changes can weaken online security, make accounts easier to hack

Cybersecurity experts have long advised people to change their passwords regularly to avoid hackers. But one security and privacy expert in Perth says this is leading users astray. RSM partner Riaan Bronkhorst says frequent changes can actually weaken online security because it pushes users toward basic combinations of words and numbers that are easy to remember, making them easier to crack and hack. The Australian Competition and Consumer Commission estimates Australians lost a total of $2.7 billion in 2023 to hackers, with about one cyber crime report made every eight minutes. It is believed there are more than 6.7 billion usernames and passwords available on the dark web. “The evolution of password protocols has changed over time, and current best practices emphasise different approaches,” Mr Bronkhorst said. “Passwords should be long, strong and unique, ideally generated by and stored in a password manager, which can be useful so that you don’t need to memorise or write them down.” His top tips for strong passwords include avoiding personal information in passwords, making sure each account has a different strong password, and changing passwords as little as possible. There are also a range of alternatives to the traditional password that can protect accounts from bad actors, including multi-factor and biometric authentication. Biometric authentication can include fingerprint scans, facial recognition and retinal scans — features which are becoming more integrated with day-to-day smart devices. Mr Bronkhorst said multi-factor authentication, such as generating and sending a code to your phone or email, should be used as often as possible to keep accounts secure even if passwords are compromised. “Selecting and remembering passwords for work systems, private banking, social media, and so many other instances has always been important and challenging in its own right,” he said. “Using best practice for passwords will make it tougher for your details to be hacked.”