• Meldroc@lemmy.world
    672·
    2 years ago

    And despite security recommendations, too many IT depts still force password resets every 90 days…

    And people confronted with this change their password from “p@55w0rd!1” to “p@55w0rd@2”. Yep extra-secure!

    • nomadjoanne@lemmy.world
      10·
      2 years ago

      Ideally we’d all use password managers, but I’m aware 99% of peoole don’t. Even with one, it’s frankly a pain in the butt to be nagged about changing it. “Man, my passwords are 20 random characters. I don’t need yo reset ot unless you’ve had a breach.”

      • Surface_Detail@lemmy.ml
        3·
        2 years ago

        Password managers are great. Until you need to log in with a new device or a device that’s not yours.

        Oh, the sixteen digit randomly generated password with two alphanumeric characters in it? Sure I remember that.

        • criitz@reddthat.com
          1·
          1 year ago

          You gotta use word-based passcodes instead of random jibberish. That way you can quickly read it from your phone and type it in.

    • AlecSadler@lemmy.world
      9·
      2 years ago

      A job I quit about 6mos ago required monthly changes. It was awful. And, yes, it absolutely led to me just incrementing a number at the end. I knew it was time to quit when I was about to hit double digit numbers.

        • AlecSadler@lemmy.world
          8·
          2 years ago

          It was a joke.

          But also, holding a shitty toxic job for 10mos took a mental health toll.

          But also, I don’t know, in some cases that might be good advice. Since 2020 I’ve changed jobs every 6-10mos and I’m making triple what I made in 2019, so that’s nice.

    • chrischryse@lemmy.world
      91·
      2 years ago

      I work in the IT section of a bank and they force a change every 30 days and can only have an 8 character password no more no less 🙃

    • The_v@lemmy.world
      8·
      2 years ago

      Some IT guys have caught on to this and require 2 digits difference.

      So “ThisJobSucks#11” becomes “ThisJobSucks#22”

      • Narjah@lemmy.world
        7·
        2 years ago

        I college we had to change our password every semester. Guess who added the semester number onto the end of their password. Hint: everyone.

        Same as a government job that required monthly password changes. Well, at least those people had more security than the post-it note on the monitor people

      • Default_Defect@lemmy.worldEnglish
        2·
        2 years ago

        NavyExchange!(ddmm of password change) for as long as I worked there, it was really only to use a register though, I had nothing compromising behind the password lock.

    • Stuka@lemmy.ml
      3·
      2 years ago

      The worst is when you have a bunch of independent systems that all have their own login info, all configured by the dame IT department, all with different forced reset timers.

    • abraxas@lemmy.mlEnglish
      3·
      2 years ago

      I’ve had arguments with clients’ IT security about this in the past where they demanded forced password resets. Citing NIST controls that insist you should avoid them was apparently insufficient.

        • pulverizedcoccyx@lemmy.ca
          5·
          2 years ago

          Then you finally do the password change, go to login and now the new password doesn’t work because you copied it to clipboard and overwrote it somehow in that small time frame goddamn shit! I always win+r and put it there until I know everything is all good.

    • totallynotarobot@lemmy.world
      61·
      2 years ago

      I promise you that does not help.

      I suspect a large number of these incidents are due to the password field in the login page allowing fewer characters than the field in the sign up page, so the password gets truncated. A couple of help desk meat shields have confirmed that for me, but mostly I think this because it seems to fix itself if I use a shorter password.

      How short, you ask? Who tf knows! They sure as shit won’t tell you! Just spend the next 20 minutes trying shit til it works, because you have nothing better to do with your time!

    • pulverizedcoccyx@lemmy.ca
      3·
      2 years ago

      My parents. All written down on paper in handy notebooks for anyone that breaks in. Two entire lives and everything in them just there for the taking.

      • abraxas@lemmy.mlEnglish
        2·
        2 years ago

        If I recall, a few (most) security experts now support written-on-paper passwords. Why? Because it is the solution for users who would otherwise commit far a more egregious security faux pas otherwise.

        In most circumstances, it is easier to keep the notebook secure than your wallet, your car, etc. And let’s be honest, the list of suspects are REALLY short if someone breaks into your house, opens the third drawer, grabs the notebook and runs. And if it’s more than that and somebody ransacks your entire house, I guarantee having to change your passwords is the least of your headaches.

        Ultimately, physical compromise is the lowest possible security risk for most people throughout their lives. Yes, it happens. Yes, it sucks. But having your bank password out in the wild with nobody realizing it is possibly far more dangerous.