Microsoft recently advised against longstanding, conventional cybersecurity logic on required password changes. It turns out forced switches made users select more predictable and easy-to-breach passwords.

"The pattern that humans use, particularly when they're not using a password manager, is they come up with, sort of, this rubric," said Pedro Canahuati, chief technology officer at 1Password. "If that's really very complex, it makes it difficult for people to gain access to it. But the reality is, humans are not good at randomness."

"The previous advice for people to rotate their passwords so frequently led to some really bad habits: people writing passwords down, only changing maybe the last digit," said Lisa Plaggemier, executive director of the National Cybersecurity Alliance.

"Changing that one character at the end of your password is not enough when you're up against a bot who's just cycling away at different passwords and switching out letters and numbers."

Humans are notoriously bad at passwords. NordPass' research of commonly used passwords across 50 countries in 2021 found the most popular were strings of letters or numbers, like 123456 and qwerty or words like a password. Most could be cracked in less than one second.

Still, if you search online for advice on how often you should change passwords, you'll still find many results saying you should change them routinely.

Newsy spoke to four cybersecurity experts about best rotation practices. While all noted that there are times when passwords should be changed — like when your data is implicated in a breach — other, more important security features can be used to strengthen data protection.

"People just need to understand that passwords only go so far, and you need multifactor authentication," said Ed Skoudis, president of SANS Technology Institute. "Password management organizations also have an obligation to keep their users secure and safe."

"The simple solution at the end of the day is to use strong and unique passwords with a password manager because nobody can create them as strong as they can with the password manager," said Craig Lurey, chief technology officer at Keeper Security. "This is hundreds of engineers, solely focused on protecting passwords in an encrypted vault that's highly secure and protected from access, and all the years of implementation that went into that versus whatever you think you can do with your notepad."

Newsy is the nation’s only free 24/7 national news network. You can find Newsy using your TV’s digital antenna or stream for free. See all the ways you can watch Newsy here.

The Russian invasion of Ukraine has split the hacking community, sending some of the most recognizable and powerful groups scrambling to pick a side to declare which has their allegiance.

In a tweet, hacking group Anonymous declared "a cyberwar against the Russian government" and has claimed to be responsible for attacks that brought down Russia Today, a state-backed news outlet, and several government websites. It also said it hacked other Russian state-TV channels.

Conti, a ransomware group with possible ties to Russian intelligence that attacked more than 290 American targets last year, declared its "full support of Russian government" and said it would use "all possible resources to strike back" at any adversaries. Cyberthreat intelligence company Orpheus Cyber reported another group united with Russia obtained stolen data from more than 45 Ukrainian government websites, and some of it is up for sale.

Motives that push hacking groups to pick a side range widely. Members of Anonymous have stated that their guiding principle is "anti-oppression," while Russian-aligned attacks may be state-sponsored. Pro-Russia attacks can also come from groups who feel pressured to operate on their behalf by the Kremlin.

"It's not entirely clear what the connection is between the ransomware gangs and the Russian government," said Brett Callow, a threat analyst at Emsisoft. "At best, they are working within a permissive environment. At worst, they are working for certain wings of the Russian government."

"Some of the actions of Russia's government just prior to the war — shutting down the REvil gang or arresting them and shutting down a number of dark web forums and shops — these cybercriminals are afraid that if they don't support the regime, they're going to be next," said Alex Holden, the founder of Hold Security.

Hacking groups may become targets for moving away from their usual financial motives for attacks. After Conti declared support for Russia, an apparent insider who objected to the group's support for Russia leaked a trove of internal chat messages and other files that Holden says "mortally wounded" the gang.

"When we see things like this, we are learning how in 2021, 2022, cybercriminal enterprises operate, so we have [the] ability to detect and deter organizations like this in the future," Holden said.

Moving forward, experts say that any further cyber escalation could spell trouble for those outside the conflict zone, including Americans. Groups like Conti could come back to hit the U.S. as well.

"They are a highly effective ransomware group, albeit one that has terrible operational security," Callow said. "They likely do still have access to certain U.S. networks that they have yet to encrypt, and they could potentially do that any time."

Newsy is the nation’s only free 24/7 national news network. You can find Newsy using your TV’s digital antenna or stream for free. See all the ways you can watch Newsy here: https://bit.ly/Newsy1

---

Trending stories at Newsy.com

In recent years, the Olympic games have become a target for cyber espionage, surveillance and other financially-motivated attacks. 

The NTT Corporation, which provided network security for the Tokyo 2020 Olympics, said there were more than 450 million cyberattacks launched during the 16 days of competition.

That's 2.5 times more than the number of attacks on the 2012 London Olympics.

Beijing won’t be much different.

A report from cybersecurity analysis firm Recorded Future found ransomware groups may try to encrypt machines used at the games, in part because it could lead to a significant profit, given that teams or officials might need to pay ransom to regain access to those systems as soon as possible. 

But experts think the biggest threat is possible cyber espionage and surveillance of athletes and visitors by the Chinese government.

The United States, Team Great Britain, Australia, Germany and Netherlands all urged their athletes and visitors to leave their personal phones and laptops back at home out of fear that they will be monitored by the government at the games and thereafter. 

"China's national security laws create a really different environment for privacy than what people are used to when they're in other countries, where privacy legislation places significant constraints on the government's ability to collect and use data," Robert Potter, CEO and co-founder of Internet 2.0 said.

"The identifiers for your phone are automatically collected, so that information is gone the moment you hit a mobile phone tower in China."

Potter's cybersecurity company Internet 2.0 examined some of the software being provided by official sponsors to the game and found that the Virtual Private Network service offered to athletes, which lets users hide and protect their internet traffic from being accessed by third parties, collected a "significant amount of user data" beyond what was needed to run the app. 

Newsy's research showed the camera and photo libraries were required to be accessed by the app, and they just didn't seem to be a particularly good reason or justifiable reason to think that that was normal for a VPN application.  

A separate report from Citizen Lab found serious privacy issues with the MY2022 Olympics app, which is required to be used by all attendees at the Beijing games.

For example, it contained an encryption flaw that could expose passport details and medical information of users. 

Both the IOC and Beijing Olympic Committee have rejected claims that there are security concerns with the MY2022 Olympics App. 

Experts told Newsy the only sure-fire way that visitors to the Olympics can protect themselves is by using new devices and accounts only while inside China in order to protect their personal information, then throw the devices away after the games are over.

China is committed to having open and accessible internet available to athletes that are within the "COVID bubble," but there is a line between open internet access and unmonitored internet access — and China is making no guarantees around the latter. 

This story was first reported by Tyler Adkisson at Newsy.

The White House picked a serious fight with Facebook Friday. The Biden administration wants social media giants to take down posts that officials flag as COVID-19 misinformation.

President Biden leveled an incredibly serious charge. 

A reporter asked him: "What's your message to platforms like Facebook?" 

President Biden said: "They're killing people. I mean, really, look, the only pandemic we have is among the unvaccinated. And they're killing people." 

Facebook was quick to fire back, saying, "We will not be distracted by accusations which aren't supported by the facts." 

A spokesperson added, "More than 3.3 million Americans have also used our vaccine finder tool to find out where and how to get a vaccine. The facts show that Facebook is helping save lives. Period." 

Biden's comments come one day after his Surgeon General issued a warning about health misinformation and directly called out Facebook.