No shit, I saw some password rules recently.
15 character minimum
Must change every 90 days
Cannot be one of the previous 24
Like, what the hell?
this post was submitted on 02 Nov 2023
409 points (100.0% liked)
196
15671 readers
2694 users here now
Be sure to follow the rule before you head out.
Rule: You must post before you leave.
founded 1 year ago
MODERATORS
Must change every 90 days
It has been 6 years since NIST told companies to stop doing this. And I'd be willing to bet there are more companies still mandating this than ones that don't.
My old job had that policy. I decided I would not try to remember my passwords. Instead I had I.T. on speed dial and I would just call them daily to change my password to the one I liked. They hated me. I don’t work there anymore. For unrelated reasons. I think.
I wish I only had to change my passwords every 90 days. That would be a dream.
I'll just have to refer to the unofficial password sticky note that everyone in the office shares containing all the usernames and passwords, and the date on which they were last changed, that was started less than a week after the password change policy.
It's hilariously insecure, but we just can't deal with the password load. It's too much work. We'd sooner be fired if we had to comply with the password policy.
I'm very glad that my company took the note and only require a password change once a year
...and that, dear admins, is how you get passwords such as fuckthisrule#54, with the number increased by 1 every 90 days.
And that's how you get rules put in place to not use a password that's similar to your old passwords. (I don't agree with such rules, just to be completely clear)
If you are forced to use long passwords, use book titles, song titles, character names, album names, TV show names, etc etc.
Examples: WutheringHeights$!5, ThePrisonerOfAzkaban:29, TheCountOfMonteChristo33&&
Of course you can put the numbers and symbols anywhere, not just at the end.
If they’re able to determine that you’re using a similar password, it’s because they’re not hashing your passwords and are storing them as plaintext. You should run far far away from any site or service that is able to enforce similarity rules. Because when you properly hash a password, even a minor difference such as upper/lowercase will produce a wildly different result.
I've been wondering about that. I think they get around it by using the "enter your current password" prompt, so they potentially have it in cleartext for the duration of the session.
it's better to use poems. I've done Hamlets 2b monologue, View From Westminster Bridge, Tell the Truth but Tell it Slanted, The Raven, Iago's Many a duteous knave, Louis the Dauphin's I am too high born to be propertied.
Or really any poem you happen to have memorized.
My company tried disabled Windows Hello/pin for some people. Which means you have to use your main Microsoft password to unlock your computer.
Which means people are going to leave their laptops unlocked or (more likely and) use a simpler password for their main account..
Such a baffling decision. They reversed course on it though. I think..
I can kind of see the advantage to disabling it, we started using Windows Hello recently and while it’s mostly been good we have seen an increase in the amount of people forgetting their Microsoft password since they no longer need to use it to sign in every day.
Just change it on the first of every month
FuckThisCompanyJanuary23
FuckThisCompanyFebruary23
FuckThisCompanyMarch23
FuckThisCompanyApril23
And so on
That's what we have. It's not too bad, but thinking of a passphrase on the spot can get anxious 😅