topic Recycling - just not for passwords, please! in Discussions & Feedback

Recycling - just not for passwords, please!

pgn — Sun, 14 Sep 2025 16:13:50 GMT

The scenario:

...

"My0ldPassword24."

"Password expired, please enter a new one:

"My0ldPassword25."

"Your new password has been accepted, please login now..."

...

Wrong move, pardner! This explains why:

https://archive.ph/mVSqV

"A spokesperson for Virgin Media O2 says: “Human behaviour is quite easy to model. [Criminals] know, for example, you might use one password and then add a full stop or an exclamation mark to the end.”"

Read and learn (link has been modified to take out the Guardian nag-prompts!)

Re: Recycling - just not for passwords, please!

Anonymous — Sun, 14 Sep 2025 16:18:36 GMT

@pgn I change my password on an annual basis.

Re: Recycling - just not for passwords, please!

madasaf1sh — Sun, 14 Sep 2025 16:47:22 GMT

You should change your password every 30 to 90 days or so, not once a year that is a security risk and you are putting your data at risk.

It should also be secured using an authenticator app or passkeys and not using SMS / Calls for MFA

@pgn
I wouldnt trust VMo2 for security advise, as they dont allow complex or over 12 character passwords... I wish VMo2 would implement support for long complex passwords and proper MFA (3FA would be ideal)