Cybersecurity - Memes

Monthly password change.
Enforced high complexity.
Sticky note on screen.

Hell, I don't even know my passwords. My password manager does. Sometimes I forget the main password but thankfully my fingers don't, unless I start thinking about it.

Isnt this just bad practice?

This 90 days password change BS, is the worst security risk there is. Do you know how many people have Summer2024 as their work computer password because of this system? too damn many! Not to mention the problem it creates for older folks who have a hard time with the change and most times end up locking them selves out. It creates far more chaos than anything secure, which I have been explaining to my company and they still enforce it for their clients.

Password1

Password2

Password...

Password28

Password29

Edit: Call IT to reset password costing the company money because of their idiotic password policy

Password...

Password43

It's even better when the company saves your old passwords, just so you can't use them again.

oh i didn't know that, are companies finally realizing that creating and trying to remember new passwords causes more trouble then keeping one really good password?

My company's HR system (like, time off, time clock, etc.) asks for a new password every 3 months, but it doesn't give any fucks at all if you just reuse the current password apparently. I've been "changing" it to the same thing for like a year now.

I'm convinced this isn't particularly secure because it just results in the following. Mandatory password change, password can't be any of your last six, bla bla bla. Boom rotating stock of my last six, you happy?

"BOB-CEMU" "BOB-MERC" "BOB-SIVA" "BOB-MILK" "BOB-CERA" "BOB-DELT"

Every three months, man. Gets old real fast.

My company changed the policy to increase the time between password changes. To compensate, they increased the required password length.

Neither of these policy changes were communicated to the employees. The expiry time tells you when it arrives (don't tell me you change it before it expires, good for you if you do), but if your new password doesn't meet the policy requirements it doesn't tell you what they are. The support request response indicated the minimum length was three letters longer. The only good thing about this ordeal is that I get paid by the hour.

Gotta do mine twice a year, always needs to be new, have a number, and a special character. It was annoying because I'm a pass phrase kind of person, but found it's not too hard to just add the year and exclamation marks for each password change into my passphrase.

Plus password managers exist so whatever.

IMO, password changes were always bs. I'm a tech, and I always disagreed with it.

Longer, better passwords were always the better option. But try to convince your average worker to memorize a 15+ character password and they'll tell you where to go.

Meanwhile... https://xkcd.com/936/

Today, with MFA.... Good MFA, not the SMS bull crap... Password "leaks" or breaches, are effectively a thing of the past.

Oh, you have my password? You guessed it, or found out leaked on some list? Cool. Good luck guessing the seed for my MFA, in the time it takes me to go change my password, locking you out of my account. MFA failures should be reported to users. Often they're not.

Short story: I once had a notice from Twitter about access to my account from a foreign location. Kudos to Twitter, since they recognised the odd behavior and stopped it (this is pre-musk Twitter BTW). I logged in, changed my password using my password manager (the previous password was too simple, from before I had a password manager), then added a FIDO MFA to my account. I tweeted out to whomever was trying to log in to my account, to thank them, as my Twitter account now had better login security than my bank. IDK why banks don't support MFA beyond sms, but that was the case at the time, and largely, that's still the case where I am.

From a security standpoint, I recommend you follow xkcd's example, generate a long passphrase for yourself, and use it to secure a password manager (and whatever recovery options they have, eg, email), and add MFA to that, and anything else that supports it.

It's a pain to do, but honestly, better than waiting to see if someone is going to be able to log in to your stuff when your password is inevitably leaked by someone.

Never is too long. Monthly is way to short. I like the idea of doing it yearly in conjunction with other it security awareness and training campaigns.

Glad we are Passwordless. Now none knows me password.

We have three month password expiry policy on AD accounts, but the requirements aren't extreme. We'd do away with it, but then we have our own CEO writing their password down on a piece of paper and giving it to us to troubleshoot their laptop (we have admin accounts for a reason ffs), after being repeatedly told not to, forcing employees to rotate their passwords suddenly doesn't sound too crazy. People are just way too irresponsible sometimes. Plus, we need to have it for certifications, so there's that.