This practice is not recommended anymore, yet still found in many enterprises.
this post was submitted on 20 Aug 2024
599 points (98.9% liked)
Cybersecurity - Memes
1959 readers
2 users here now
Only the hottest memes in Cybersecurity
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
My company's HR system (like, time off, time clock, etc.) asks for a new password every 3 months, but it doesn't give any fucks at all if you just reuse the current password apparently. I've been "changing" it to the same thing for like a year now.
Which is often a lot more secure than requiring you to create a new password. Requiring a new password frequently leads to people making memorable passwords which are a lot less secure than a good password which is kept for years.
A few years back, my company suffered a big cyber attack where the attack vector was the credentials of a high level user who frequently changed their password to the year and month for next password change, i.e. "2018october". Apparently this was common enough that the attackers were able to brute force/guess it.
I prefer that.
I've changed my password 11 times since I worked at this job.
How do I know that? Because my solution has been password+1.