I was so happy when we finally hired a director of security and the first thing he did was stop forcing us to rotate passwords every month.
It was so fucking insane.
post
replies:
I've done a lot of internal infrastructure pentests, for companies of various sizes, and there wasn't a single pentest where spraying MonthYYYY for the past two months wouldn't get at least one hit.
That, and the fact that every company has at least one server hidden somwhere that's still vulnerable to MS17-010, that they can't update or replace for one reason or the other.
replies:
Capital letter at the start. Numbers at the end. Exclamation point at the very end.
It's scary that this is a pattern so many of us does instinctually.
It's a good thing I began using KeePassXC 2 years ago..
[deleted]
replies:
They'll never figure out my secret technique... TWO exclamation points!!
replies:
All this is correct. But I’ll also add the following:
Most people probably DGAF if their password for work is compromised. They have no skin in the game for whatever their data entry or email is for BigCorp, they’re treated like “monkey push button, monkey get banana,” forced to jump through password hoops and they’re sick of doing it every few weeks or months. So they use the simplest they can get away with and the easiest to remember so they don’t have to call some corpo IT help desk that will roll their eyes at yet another password reset.
replies:
Every competent InfoSec dept knows that NIST recommenda a strong password you never rotate unless compromised and yet every corporate policy I've ever witnessed forces password rotation constantly.
Security is 100% theatre.
replies:
Don't let the user choose their password. Use passkey and randomly generate a secure password. Encourage passwordless login.
replies:
I do the exlamation mark thing!!!
replies:
Now tell us about passkey.
Damn, someone figured out my super secret formula for making super strong passwords! What am I going to do‽
new policy: your password must not have been used by any other user in our system. That’s it.
"Sorry, you can't have that password. Someone else''s already using it" is an amazingly useful piece of information to give someone, even an existing employee.
No shit, Sherlock (c). I know nothing about cyber security and even I read somewhere years ago exactly the same: forcing password rotation with complexity rules does not make anything more secure
replies:
all 55 comments