Washington

Most office drones have had to deal with a job that requires them to keep changing their passwords like clockwork, maybe every six months or so. The longstanding information technology (IT) security practice is based on the idea that flushing out old passwords will cut off access for bad guys who may have figured them out.

But according to the US Federal Trade Commission's chief technologist, Lorrie Cranor, the strategy has some major holes.