How often should I change my WiFi password? I moved it every month for the first three years, but now I only move it once a year.: When to change and why not to change

I had a security fetish three years ago: I saw an article saying "WiFi passwords should be changed every three months", so I did so. Set up a mobile calendar and enter it every beginning of the month 192.168.1.1 Change the password from Zhang2023wifi Replace with Zhang2023wifi2 , and then change to wifi2023newZ . I persisted for three years and gave up completely last year. The reason was that the TV at my mother-in-law's house couldn't connect to the Internet. I struggled remotely for 40 minutes before I remembered that I had just changed her password to the fifth version last week. The TV is a device that does not automatically pop up the password box. Once the password is changed, the connection will be lost immediately. That day I was sitting on the sofa thinking: Who did I prevent by changing my password so diligently?

After thinking about it, the answer is a bit disturbing: No one was on guard, and they even messed with their own equipment. . In this article, I’ll go over it from the beginning.: How often is it reasonable to change your home WiFi password? Under what circumstances must you change it immediately? When you really need to change it, how can you minimize the damage to your family's devices? These are all things I paid for myself, not a safety manual.

Let’s talk about the conclusion first: Changing it once a year is too frequent, but it is worth doing in three situations.

My current caliber is: The password itself is long enough (12 digits or more), so you don’t need to touch it on a daily basis. Changing your password will only follow “leak events”, not the calendar. .

Many articles say that passwords should be changed every three months or every half a year. This logic is transferred from company account management - hundreds of people on the company intranet share a system. Changing passwords regularly can compress the exposure window of "the password has been leaked but no one knows it". This is not the case at home. The attack surface of your WiFi password is not at the same level as that of the company. The benefits of frequent changes are close to zero, but the cost is real.: Every time it is changed, mobile phones, TVs, cameras, sweepers, and door locks all have to be moved accordingly. I am here The article about being disconnected after changing the password Counting times, I have to touch 17 pieces of equipment during a trip to my house, and the fastest trip takes more than half an hour.

There are three situations where you really need to take action. If you encounter it, replace it. If you don’t encounter it, keep using it.:

• Confirm or suspect that the network has been hacked (an unrecognizable machine appears in the device list)
• The password has been told to others - the decorator, the tenant, the relative who came to stay for a week. It should be changed when the person leaves.
• Someone at home has installed a WiFi sharing app like "Master Key" and used it to connect to your home

What these three situations have in common: They are all "the password has been lost", and changing the password is to invalidate it. Changing it frequently if the secret is not leaked is equivalent to changing the lock cylinder every year even if the security door has not been broken into. If the lock cylinder is not broken, why do you replace it?

Want to understand this: Your password is not calculated, it is shared.

Many people subconsciously change their passwords frequently because they are afraid of being “cracked by hackers.” I used to think so too, until I took apart the WPA2 verification process and looked at it. The router uses a four-way handshake to verify the password, and the password body is not transmitted throughout the process. The person who captured the packet gets the encrypted verification data. To restore the password, the only way is to use a dictionary to try one by one. I am here The four-way handshake I have calculated this account: A password of 12 uppercase and lowercase letters plus numbers. The character combination is on the order of 62 to the 12th power. If you use a high-end graphics card array to run the dictionary, the time unit will start with "ten thousand years". Pure numbers with less than 8 digits, birthdays, and mobile phone numbers are indeed not strong enough, but that means the password is set too weak. The solution is to set a long password instead of changing it frequently - if you change to the next weak password, it will still be broken in seconds.

So how do thieves who exploit the Internet get in in reality? I helped my neighbor deal with it twice, and the path was exactly the same.: No one cracked it at all, the password was "sent" out. . One way is to use apps like Master Key. When someone installs it and connects to your home WiFi, your home hotspot may be automatically uploaded to its shared gallery, and all users on the network can connect to it. I'm here The anti-robbing website article This mechanism has been dismantled in detail. The other way is simpler - you give the password to someone else yourself. During the months of renovation, my family's password passed through the hands of three masters. Who can guarantee that they wouldn't write it down casually in the order book?

These two roads have a common feature: Frequently changing passwords will not prevent them . You change it every month, and the Key App users will change it again next month, and the new password will be added to the gallery. ； You report the password to the next master, and the leak cycle starts over again. It's like if there's no problem with the door lock, but the key is being taken out all the time, what's the point of changing the lock cylinder?

What did I get in exchange for the three years I changed my password every month?

Looking back at those three years, I changed about thirty versions of passwords, and the list of gains is as follows: The TV lost contact 4 times, including the time at my mother-in-law’s house where the TV was remotely controlled for 40 minutes. ； The door camera was disconnected three times. One time it was disconnected on the second day of traveling. When I returned home, I found that the door camera was black for a whole week. ； I have reconfigured the sweeper twice, and each time I have to turn the machine over to find the reset button. ； I lost count of the number of times my mother called me to ask, "What's the password?" Anyway, she later wrote a line on the refrigerator magnet specifically to remember this.

The attack to be defended is: zero . In the past three years, no strange machine has appeared in the equipment list, which means that no one has come in at all. My thirty versions of passwords protect against an enemy that does not exist.

There is also a counter-intuitive price: Changing passwords frequently will force people to make their passwords simpler and simpler. In the first edition, I compiled 14 digits in a regular manner, but after switching to the tenth edition, I started to use it lazily. wifi2024a , wifi2024b With this kind of postponement, we might as well switch to the thirtieth edition. 11223344 The top number - I can't remember it because it's too complicated, and I can't even connect it after correcting it. In the end, after changing frequently, I changed my password to a weaker one. This is my biggest lesson in the past three years. I have an account for password strength. The special character article Calculated: The length is more valuable than anything else. The 12-digit alphanumeric characters are mixed together and can be used until the router is decommissioned.

Under what circumstances must a change be made immediately?: Trigger conditions and accompanying actions

Organize the judgment of "should be changed" into a table. Don't hesitate when encountering the situation on the left. By the way, also do the column on the right - just changing the password without blocking the source will equal to changing the password and then leaking it.:

Don't rely on your own feelings to determine if someone has been scammed. The most accurate way to determine is to check the device list in the backend. Now five mainstream backends have a "new device connection notification" switch. As soon as a device connected to the Internet is connected, a reminder will pop up on the phone. It is much faster than looking through the list to catch the thief afterwards. I have written down the switch positions of each company. Automatic reminder for new devices inside. I turned it on at my parents' house and my mother-in-law's house. Last year, I tried to use a strange phone once. I kicked it off and changed the password on the spot. It took ten minutes to solve the problem.

Let’s talk about the fourth situation: The router is second-hand. This matter has nothing to do with password leakage, but many people ignore it - your home WiFi password and broadband dial-up account are stored in the old router. Directly selling it is equivalent to giving the key with the machine. Restore the factory before sending the express. This action takes three minutes. I have written before that the Tenda reset button and the WPS button are in the same trap. If you press it too much, the whole house will be disconnected. Don't use the Internet peak to do this.

If you really need to change, here are four steps to minimize the damage.

If you encounter any of the items in the above table, follow this order. In actual testing at my home, the complete set requires half the equipment effort compared to a no-brainer replacement.:

The first step is to pick a time. Choose a night when the whole family is together and you're not in a hurry. Don't choose a ten-minute window in front of the door. Devices such as cameras and doorbells need to be reconfigured after being disconnected from the Internet so that they can be easily operated at home. I chose Friday night for the trip to my mom's house, so I could finish it slowly and still have time to review it.

The second step is to think of a new password before changing it. Don’t edit half of it on the spot. The caliber is the same as the usual password.: More than 12 digits, uppercase and lowercase letters plus numbers, without birthday number. Type it in the memo on your mobile phone first, copy and paste it to avoid the tragedy of entering the wrong person in the background and reconfiguring the whole house.

The third step, after saving, don’t rush to get the equipment, wait two minutes. Some machines will automatically recover after changing the password - once the TV box is powered off and restarted, the password box will often pop up. There is no need to go into settings and delete the network. Let the bullets fly for a while before taking action, you can save several units. If it really needs to be reconfigured, follow the order of "first the mobile phone, then the elderly device, then the camera doorbell". Specifically, which type of device goes which way? How to save four types of equipment It's all in that article, and the order of the 17 units in my home is based on it.

The fourth step is to finish the inspection in two places. Twenty minutes after the change, I went into the backend and glanced at the device list. Have everything that should come back been returned? By the way, set a separate password for the guest network - when guests come and connect to the guest network, the main network password does not need to be transmitted externally. This is a fundamental way to reduce the number of "password reporting" times. Another reminder, for dual-band routers with separately named routers, 2.4G and 5G are two boxes. If you only change one, the other will still have the old password. My family missed changing the 5G the first time, and it took my neighbor half a month to find out. Don’t get stuck on this detail.

ending: Instead of replacing them frequently, it is better to repair these three gates

The actual state of my home now: The main network password has not been changed for more than a year, but the device reminder is on, the guest network is always available, and there are no shared WiFi apps on my family’s mobile phones. These three gates are much more useful than changing passwords every month, because they block the real leakage channels, rather than showing off "I take security very seriously."

Give a practical ranking: First go to the background to open a new device connection reminder (it only takes five minutes, and the efficiency of catching thieves is doubled) ； Then check whether your family’s mobile phone has an app such as master key installed (if there is, deal with it first, and then consider changing the password after it is dealt with) ； Finally, set up the guest network (guests will never be able to touch the main network). After doing these three things, you will most likely find that the WiFi password can really only be used once a year, and the TV, camera, and sweeper at home will thank you.