No shit, I saw some password rules recently.
15 character minimum
Must change every 90 days
Cannot be one of the previous 24
Like, what the hell?
Must change every 90 days
It has been 6 years since NIST told companies to stop doing this. And I’d be willing to bet there are more companies still mandating this than ones that don’t.
I wish I only had to change my passwords every 90 days. That would be a dream.
I’ll just have to refer to the unofficial password sticky note that everyone in the office shares containing all the usernames and passwords, and the date on which they were last changed, that was started less than a week after the password change policy.
It’s hilariously insecure, but we just can’t deal with the password load. It’s too much work. We’d sooner be fired if we had to comply with the password policy.
…and that, dear admins, is how you get passwords such as fuckthisrule#54, with the number increased by 1 every 90 days.
And that’s how you get rules put in place to not use a password that’s similar to your old passwords. (I don’t agree with such rules, just to be completely clear)
If you are forced to use long passwords, use book titles, song titles, character names, album names, TV show names, etc etc.
Examples: WutheringHeights$!5, ThePrisonerOfAzkaban:29, TheCountOfMonteChristo33&&
Of course you can put the numbers and symbols anywhere, not just at the end.
If they’re able to determine that you’re using a similar password, it’s because they’re not hashing your passwords and are storing them as plaintext. You should run far far away from any site or service that is able to enforce similarity rules. Because when you properly hash a password, even a minor difference such as upper/lowercase will produce a wildly different result.
My company tried disabled Windows Hello/pin for some people. Which means you have to use your main Microsoft password to unlock your computer.
Which means people are going to leave their laptops unlocked or (more likely and) use a simpler password for their main account…
Such a baffling decision. They reversed course on it though. I think…
Next step: The Password Game