Google: Change Your Password Twice a Year to Keep Safe

Change your passwords twice a year and never reuse them. Those are a few of the tips Google lists in an online security checklist that helps people stay one step ahead of the scammers.

With most Internet users now wary of spam messages, fraudsters have increasingly focused on popular Web services such as Gmail, Facebook, Yahoo, and Hotmail. They break into accounts and then send their messages to the victim's contacts, hoping that the spam will be more effective because it comes from a friend. "People are far more likely to respond to a message from someone they know," said Andrew Brandt, lead threat researcher with antivirus vendor Webroot, speaking via instant message.

The spam can include links to fraudulent pharmaceutical Web sites, phoney phishing pages, or pleas for money. In one scam that has been run for more than a year now, the criminal pretends that he's trapped in a foreign country and asks friends of his victim to wire him funds.

Victims usually don't know how their accounts were compromised, but according to Google there are several ways this can happen. User names and passwords are often stolen in phishing attacks, or via malicious software that records them as they are typed into the computer. Sometimes the criminals hack into Web sites that are linked to Google accounts. "If that site is hacked and your sign-in information is discovered, the hijacker has easy access to your Google Account,' wrote Priya Nayak, an online operations strategist with Google in a Friday blog posting.

And sometimes the bad guys simply guess right. "You use a password that's easy to guess, like your first or last name plus your birth date ('Laura1968'), or you provide an answer to a secret question that's common and therefore easy to guess, like 'pizza' for 'What is your favorite food?,'" Navak wrote.

Keeping your password changed, and using one that's hard to guess, can help thwart many of these techniques.

Webroot's Brandt said that Google's advice for twice-yearly changes is reasonable. He thinks people should change their passwords as often as they can. "I change my passwords at least four times a year, but I'm a security nerd and use password manager software which generates the passwords and reminds me to change them."

Brandt users a password manager that comes with Webroot's security software, but there are free options too. Keepass are two popular choices.

Even with password managers, it's a chore to keep on top of all the different log-in information that most people need to surf the Internet. But for important accounts, the work is worth it, according to Google.

"Online accounts that share passwords are like a line of dominoes," Nayak wrote. "When one falls, it doesn't take much for the others to fall, too. This is why you should choose unique passwords for important accounts like Gmail (your Google Account), your bank, commerce sites, and social networking sites."

Released last week, Google's checklist includes 18 basic security tips that everyone using the Internet should know.[source]