When was the last time you changed your Apple ID Password?

[Rod]

I horrified to admit it was in 2015. It's he sort of thing that's easily put off, I mean I've got 2FA/2SV not that we really have any choice any more which is a good thing.
So, it's easy to get slack but a recent major security beach of the second largest Telco in Australia a week back made me sit up an think.
The good news is it's not all that difficult. I performed the process online using Safari on my MBP but it can be done on iPad, iPhone or Mac.
You get the option to log out of all your other devices and it's a simple matter to follow the prompts to log back in on each device.
I did run into one little catch with my Apple Watch (AW). After signing in on my iPhone my AW asked that I sign in with my new password as well. I was stumped for a few minutes until I realised I could type into the AW using the iPhone keyboard. Of course until I picked up my iPhone I didn't realise that was an option. I didn't have an AW in 2015.

Bottom line, took me about half an hour including creating an App Specific Password for my Apple email address/calendar on Spark.

 

[pm-r]

Regarding my online passwords I tend to follow the fairly recent thinking:

If you have strong passwords, you probably don't need to change them frequently. Thomas Trutschel

There's no set, optimal metric for how often you should change your passwords.
Most security experts believe that if you have a strong and unique password, you shouldn't change it unless you believe it's been compromised.
Other experts recommend changing passwords several times a year, but this practice is falling out of favor.

How often you should change your passwords, according to cybersecurity experts

There's no set, optimal metric for how often you should change your passwords, and expert advice on the topic varies.

www.businessinsider.com

I'm sure many user's unfound paranoia will have them using some other methods. ;-)




- Patrick
=======

 

[Raz0rEdge]

I use a password manager to manage all of my passwords and generally use at least 32-characters unless the site has restrictions on length. I also enable 2FA/MFA on all sites that support it.

With that, I generally update my passwords on a 2 year cycle, so 2020 was the last time my Apple ID password was changed and it looks like it's time again now.

I do the rotation not because of anything being compromised, but essentially this forces all logged in devices to require a password re-entry which allows me to remove devices that don't need access anymore to all of my accounts.

 

[pm-r]

I do the rotation not because of anything being compromised, but essentially this forces all logged in devices to require a password re-entry which allows me to remove devices that don't need access anymore to all of my accounts.

Thanks Ashwin, that's a very interesting idea and concept.



- Patrick
=======

 

[Rod]

I was further motivated by my password manager which suggested my Apple password was very weak. It was the standard composition, 10 characters, upper an lower case random letters and numbers but these days 10 characters doesn't seem to be enough and I avoid symbols but maybe that's an old phobia?

 

[pm-r]

but these days 10 characters doesn't seem to be enough and I avoid symbols but maybe that's an old phobia?

I logged into an account I don't very often use a few weeks ago and was told I needed to add a special symbol character to my existing alphanumeric password so I added an asterisk (*) for the last character and then later on I received a notice that I had used an illegal character. So I had to go back to their website to see if I could find what they classed as a legal symbol character but had to give up and wrote them a snarly letter. I haven't heard back but I don't need their services really anyway so to **** with them.

So I guess my account is fairly safe as it is even if I cannot access it.

I wonder who they use to manage their systems???


- Patrick
=======

 

[Rod]

I have had similar experiences but a long time ago now. I've also read a few posts where people using symbols on their Apple ID password ran into troubles but that was a while ago too. I did think of adding a question mark but decided against it in the end.

 

[IWT]

I'd dearly love someone to explain why you need any of these "symbols" IF one has a 20 character PW with Upper Case, Lower Case, numbers, randomly scattered.

Keyboards vary as to their layout of "symbols" - eg £, $, € depending on your country of origin and some countries/languages have "symbols" unique to them.

BTW, I gather from several comments by "experts" that the commonest "symbol" used is !

Ian

 

[pm-r]

BTW, I gather from several comments by "experts" that the commonest "symbol" used is !

I'm surprised it isn't "the Finger" symbol. ;-)

That would seem fairly appropriate if someone was attempting to use your password.



- Patrick
=======

 

[Rod]

BTW, I gather from several comments by "experts" that the commonest "symbol" used is !

Ian

I guess that is a pretty universal symbol as I would have thought is the "?" but I'm still shy of using them with important subscriptions. On the other hand my Telco here in Indonesia insists on at least one symbol but its subscriptions are limited to one country so no international keyboards involved.

PS. You didn't answer the question though.

 

[IWT]

You didn't answer the question though.

Oh yes, sorry. About 3-4 years ago.

Ian

 

[pm-r]

Oh yes, sorry. About 3-4 years ago.

Hmmm...??? Why so often Ian??? ;-)

That's at least double the time between my considerations of even thinking about changing mine unless I am forced to change one.



- Patrick
=======

 

[IWT]

Hmmm...??? Why so often Ian??? ;-)

Patrick, I can't recall exactly how many years ago; but what I do recall is why -

I am one of those who had an @me.com email address followed later by an @iCloud address which is related to my Apple ID and they remain separate. One for iTunes, App Store and the other for Apple ID & syncing etc via iCloud. The usernames were different, which I can't change; but they also had different PWs.

Finally, I got fed up with trying to remember these 2 PWs and decided to have the same PW for each. So I constructed a very long PW and .................it's too boring really

Ian

 

[pm-r]

Finally, I got fed up with trying to remember these 2 PWs and decided to have the same PW for each. So I constructed a very long PW and .................it's too boring really

Ian

And for an even easier method... ;-)




I read somewhere that the most often used password is the word itself "password".

Some even modify it with upper/lowercase and numerals to replace some characters, ie: 0 for o, 3 for E etc.



- Patrick
=======

 

[Rod]

Hmmm...??? Why so often Ian??? ;-)

That's at least double the time between my considerations of even thinking about changing mine unless I am forced to change one.



- Patrick
=======

Makes me feel better now.

 

[pm-r]

Makes me feel better now.

I'm so I'm so glad I was able to make you feel better Rod, and I guess it's a good thing to stay reasonably on top of these things, but I don't see any real reason to rush into making any changes.

It always struck me as a bit odd that I needed such recommended elaborate passwords to access my own data on some server owned by somebody else over which I have absolutely zero control on what they can do with their computers or even the how well protected they are.





- Patrick
=======

 

[krs]

I don't think I ever changed my Apple password.

Is there any particular reason why I should?
Like what nasty things can anyone do logging into my Apple account?

 

[pm-r]

Like what nasty things can anyone do logging into my Apple account?

Could they possibly access your name and credit card account details and number???

Otherwise, I don't really know. But I'm sure if that happened most credit card companies would cover any illegal costs or charges, if not Apple themselves.

They seem to take great pride in protecting privacy.




- Patrick
=======

 

[krs]

Could they possibly access your name and credit card account details and number???

They would get my name and address for sure, but I try to use Paypal where possible so my CC info is out there as little as possible.

I don't like 2FA (at least via cellphone) because, at least in Canada, it is ridiculously easy and quick to take over someones cellphone number.
The 2FA info would then go to them before one even knows one's cellphone number has been transferred.
Banks at least offer 2FA via a landline number where the authorization code is a spoken message.

 

[MacInWin]

Most 2FA setups offer to use an email address instead of a text. Slower, a bit, but it is there.