4 ms·

"Forced periodic password change has got to be near the top of the list in terms of the dumbest things" Totally agree. I often encounter problems that go like

• tajen 10y ago
  Tip: Some systems only remember your last 3 or 10 passwords, so it's worth rotating up to Password9 and then coming back to Password0. Tip given by my boss who received it by his chain of command of old people who couldn't remember the password change. True story.
  • Jaruzel 10y ago
    Which is why in a lot of corporate systems, the password history is set to 13 last passwords. a) it prevents a 0-9 rotation, and b) it also prevents people rolling passwords based on month name or number.
    • dzdt 10y ago
      Why is why password rolling is then based on an alphabetical roll, or pure numerical increment, or month and year. No real entropy gain!
    • daneyh 10y ago
      August2016 September2016 October2016 etc. pls don't hack me
      • Jaruzel 10y ago
        I didn't say it was a good system ;) As the implementer, I've argued many times about it, but the ITSec bods always think they know best.
    • gpderetta 10y ago
      That's what hexadecimal digits are for :)
    • MereInterest 10y ago
      Do they put a maximum on how many times you can change your password? If not, you could just cycle through 13 passwords in 5 minutes, then switch back to your original password.
      • mlnhd 10y ago
        I wrote a PowerShell script that does exactly this for Windows Domains. http://pastebin.com/raw/ytwy0nCB http://pastebin.com/raw/ytwy0nCB
        • Jaruzel 10y ago
          In AD there is a MinPasswordAge policy that is typically set to 1 day to thwart exactly this type of work-around.
  • Ntrails 10y ago
    I'm not sure that it makes much difference whether I reset to 0 or keep going through 10 and up. My biggest frustration is that every password change I'll mistype my closing digit for about a week before muscle memory gets the new one right, (Although this time I had a unique experience where I adjusted quite quickly from "2" to "3" and because I was still thinking "don't forget to incrememnt" ended up typing "4". Uggggghhhhhhhhhh)
    • TeMPOraL 10y ago
      ... and then you get locked out because your domain controller (or whatever) is set up to ban you after ~3 invalid login attempts in a row. Happened to me once.
• vincnetas 10y ago
  Fun fact. In my organization we are required to change password each three months, so now im on ...24 and i can calculate from that how long i been working here :)
  • user5994461 10y ago
    Instead of numbers, you can also use spring-summer-autumn-winter.
• beedogs 10y ago
  This is exactly what I do as well. Well, when I'm not getting the AD admins to let me reset my password directly from the admin console.
• Ajedi32 10y ago
  This is what I used to do before I started using a password manager. Now I just change my password to a new, randomly generated one every month while my master password stays the same.
  • kbart 10y ago
    Sure, but this method doesn't work when I need to login to my corporate PC at work.
    • Ajedi32 10y ago
      It does for me. KeePass on my phone + InputStick. I've even got a macro set up to enter all the necessary keystrokes so I can login with one tap. (Ctrl+Alt+Del -> Enter Password -> Enter)
      • taco_emoji 10y ago
        Thank you for introducing me to InputStick!
        • Ajedi32 10y ago
          You're welcome. I discovered it myself only around 6 months ago, and so far I've found it to be very useful. Their website lists a lot of different potential applications, but I use it almost exclusively for entering passwords from KeePass. In addition to allowing password entry on the computer's lock screen, it also saves me the trouble of having to read and retype passwords manually on computers that don't have KeePass installed, and avoids exposing my entire password database to the computer it's plugged into (as would be the case if I used portable KeePass on a USB memory stick).