And despite security recommendations, too many IT depts still force password resets every 90 days…
And people confronted with this change their password from “p@55w0rd!1” to “p@55w0rd@2”. Yep extra-secure!
I work in the IT section of a bank and they force a change every 30 days and can only have an 8 character password no more no less 🙃
Ideally we’d all use password managers, but I’m aware 99% of peoole don’t. Even with one, it’s frankly a pain in the butt to be nagged about changing it. “Man, my passwords are 20 random characters. I don’t need yo reset ot unless you’ve had a breach.”
Password managers are great. Until you need to log in with a new device or a device that’s not yours.
Oh, the sixteen digit randomly generated password with two alphanumeric characters in it? Sure I remember that.
A job I quit about 6mos ago required monthly changes. It was awful. And, yes, it absolutely led to me just incrementing a number at the end. I knew it was time to quit when I was about to hit double digit numbers.
Some IT guys have caught on to this and require 2 digits difference.
So “ThisJobSucks#11” becomes “ThisJobSucks#22”
How would they know how many digits changed? They don’t store the password in cleartext.
Right?
…
Well they don’t need to store it to a drive. You just entered your old password in order to login and authorise your password change.
It’ll still be in memory against your session.
Used to have monthly changes for a Microsoft account. When trying to change, it said “You used this password 6 months ago, please use another”, besides the “passwords needs to be at least this different” message. Clearly they are storing them, not sure if they’re stored cleartext or they’re decrypting them on the fly somehow
No you don’t need to store anything in clear text to check password parameters
You could take the old password, change one or two letters and compare the hash to the hash of the new password?
I college we had to change our password every semester. Guess who added the semester number onto the end of their password. Hint: everyone.
Same as a government job that required monthly password changes. Well, at least those people had more security than the post-it note on the monitor people
> And despite security recommendations, too many IT depts still force password resets every 90 days…
It could be for contractual or for insurance reasons. We have some contracts with government agencies that require it, and our cyberinsurance also does. Even though NIST has been recommending for years to do long passphrase + MFA and no reset unless you suspect compromise.
So yeah, the reason behind this might not be just plain incompetence.
Who still isn’t using a password manager?
The most infuriating part is when this happens while using a password from a password manager
Then you finally do the password change, go to login and now the new password doesn’t work because you copied it to clipboard and overwrote it somehow in that small time frame goddamn shit! I always win+r and put it there until I know everything is all good.
What if I were to tell you my password manager password is the most vulnerable of all?
Nobody would guess it’s hunter2.
Mine is bigboipassword123. Can’t dictionary attack it cuz boi isn’t in the dictionary.
I promise you that does not help.
I suspect a large number of these incidents are due to the password field in the login page allowing fewer characters than the field in the sign up page, so the password gets truncated. A couple of help desk meat shields have confirmed that for me, but mostly I think this because it seems to fix itself if I use a shorter password.
How short, you ask? Who tf knows! They sure as shit won’t tell you! Just spend the next 20 minutes trying shit til it works, because you have nothing better to do with your time!
My company doesn’t tell you what the AD policy is for changing your domain logon password but windows will just tell you that it doesn’t meet the policy. What IS the password policy you ask?
Well it’s uh… 🤷♂️
Try again!
I am annoyed on your behalf.
I’ve had goons tell me they can’t tell me the character max because of “security”
My parents. All written down on paper in handy notebooks for anyone that breaks in. Two entire lives and everything in them just there for the taking.
If I recall, a few (most) security experts now support written-on-paper passwords. Why? Because it is the solution for users who would otherwise commit far a more egregious security faux pas otherwise.
In most circumstances, it is easier to keep the notebook secure than your wallet, your car, etc. And let’s be honest, the list of suspects are REALLY short if someone breaks into your house, opens the third drawer, grabs the notebook and runs. And if it’s more than that and somebody ransacks your entire house, I guarantee having to change your passwords is the least of your headaches.
Ultimately, physical compromise is the lowest possible security risk for most people throughout their lives. Yes, it happens. Yes, it sucks. But having your bank password out in the wild with nobody realizing it is possibly far more dangerous.
My grandma does this, but they’re in one of the many Bibles she has in her home.
1 week later: EZ Pass has majority of user passwords compromised, giving hackers access to bank records of 8 million Americans.
That’s even more reason to use a password manager. You’re far more likely to have unique passwords per site. If one gets compromised, others don’t.
Idk who is safe to use for password mgmt. I haven’t seen data leaks for my banking institutions who probably have enforced regulations for IT security. Are there standards in place for password manager products? What brands are reputable?
I do use a password manager but this shit still happens. Does anyone know why? Something to do with a “password hash”, I think…
Why am I in this picture?
I won’t say where I work but we have strict password requirements including that they have to be exactly 8 characters long.
Yeah our passwords aren’t very secure as we also have to change them every 90 days and if you miss the window by 3 days you have to call the IT desk to reset it which takes about 45 minutes to an hour. And in that time you basically can’t get anything done.
At home I use a password manager and all my passwords are randomly generated and whenever possible 2fa is enabled.
Not sure if you’re in the US. But if you are, you should leave this anonymously on the security team’s desks.
> Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator. - NIST control SP 800-63B Section 5.1.1.2
Basically a fairly widespread standard of security. All kinda of complaince you can fall out of if you do business with anyone who cares about NIST controls.
Get as many people as you can to change their password on or around the same day. 93 days later either bombard IT with simultaneous requests or maybe stagger them to eat up their resources for days.
I use bitwarden on my android phone and home computer. Vivaldi browser on both devices with bw integration. I also was able to portable-load Vivaldi on my work pc, so one day when I’m not too busy, I intend to regen my work passwords (everything but the domain logon is web-based) with bitwarden so I never have to worry about how many ones and exclamation points I appended to my passwords.
Now if I could only get them to replace Microsoft 365 OTPs with a smart card or RSA hardware token that’d be perfect. Especially when Teams and every other Microsoft app separately and individually decides for the nth time this week that they all need my credentials again because somebody sneezed near the work VPN server and caused the ntp to be off by a millisecond and invalidate my security certificate or… whatever the reason that happens.
And that’s why I generate my passwords randomly.
Thank you Bitwarden.
