1047
Anon witnesses excellent security (sh.itjust.works)
submitted 1 year ago by to c/greentext@sh.itjust.works
95 comments fedilink hide all child comments
 
you are viewing a single comment's thread
view the rest of the comments
[–] 30 points 1 year ago (9 children)

Don't forget your new 32 character/symbol/number/nordic rune passwords that will need to be changed every 17 days.

  • permalink
  • fedilink
  • source
  • hideshow 9 child comments
    •
  • [–] 17 points 1 year ago (3 children)

    I hate sites that make me constantly change passwords. it's been shown time and time again that making users change passwords often decreases security by a pretty large factor, and yet a lot of sites still do it

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 11 points 1 year ago

    Our workplace did that. You had to change every month and you weren't allowed to just add a digit. It meant that people started writing their passwords on post-its stuck to the monitor.

    Mind you, back in the 90s your password was the same as your username. It was very handy, because if someone went home leaving a document locked, you could just log in and unlock it. Our first "proper" IT professional was horrified.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 7 points 1 year ago (1 child)

    Interesting, stopped seeing this a while back. Forced change after the inevitable hack though of course

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] [S] 8 points 1 year ago

    Could be because OWASP now actively recommends against periodic password changes.

    Ensure credential rotation when a password leak occurs, at the time of compromise identification or when authenticator technology changes. Avoid requiring periodic password changes; instead, encourage users to pick strong passwords and enable Multifactor Authentication Cheat Sheet (MFA). According to NIST guidelines, verifiers should not mandate arbitrary password changes (e.g., periodically).

  • permalink
  • fedilink
  • source
  • parent
  • [–] 5 points 1 year ago (3 children)

    And don't forget required 2-factor authentication, in an age where that becomes 1-factor authentication as soon as someone has your phone, because both factors are accessible there!

    2FA is utterly worthless in the age of smartphones, and whenever my employer tries to implement it, I refuse and tell them that, if they want me to do 2FA, they can either provide me with a work phone, or they can give me a USB key that is just going to sit in my desk drawer.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 1 year ago (1 child)

    There are other ways to 2FA, such as having a physical key on yourself /srs

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 1 year ago

    Hence why I tell my employers that I'm good with h That option (see the last bit of the comment to which you replied) the problem is that this method of 2FA is not implemented commonly, and so most systems I've encountered bug out when trying to set it up.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 6 points 1 year ago*

    which still requires someone to swipe the phone and the owner not recognizing it long enough to do a remote wipe. I am not someone who hangs on the smartphone 8 hours per day, and even i would realize my phone is gone within 15 - 30 minutes, giving an attacker a pretty small time window to act.

    e: and they have to break into the phone as well - if it's updated, that might buy more than enough time

  • permalink
  • fedilink
  • source
  • parent