6 ms·

Mine is my workplace. They mandate changing the password every 3 months (so most people use post-its) and their password change utility accepts special characte

Mine is my workplace. They mandate changing the password every 3 months (so most people use post-its) and their password change utility accepts special characters for input but mingles them when actually stores them (the backend uses AD for authentication, but the password change goes through a custom web form). And of course then logging in doesn't work at all. It took me days to figure out what was going on. I have to avoid symbols and special characters when I have to renew my password there from now (luckily with pass it's just another command line switch).

y4mi 7y ago
Just use an ultra secure password schema such as September2019@$ . They obviously want you to use it considering that policy
- martin_a 7y ago
  Same here. Using a base password and adding the month in which I changed it the last time. If somebody feels happy about that, so be it.
- Twisell 7y ago
  I once tried Password1 scheme as a form of protestation for a client corp account I'd connect every 2 month or so but that had a 1 month rotation policy (so that I actually had to change my password every time I connected to them). It worked... Obviously I changed it to something else but regularly tried if still worked. The big payout was when we had an on-site formation from a third party and the teacher needed to create a corp account. He miserably failed to validate various secure combinations against policy (like 16+ length 5 words xkdc style). Being the only consultant associated, I just yelled across the room full of in-house IT guys "Just try Password1 it's gonna make it!" Obviously it worked out ¯\_(ツ)_/¯ PS: Oh and nobody reported me for this "incident" I still don't know if it's out of shame, dumbness or because nobody wanted to actually get to work to change that policy.
  - myself248 7y ago
    Oh yeah. Yeeeears ago, I was contracting for a telecom provider, and as a contractor, the process for getting logins to all the stuff I needed access to was onerous in some cases, nonexistent in others. So the employee who was sponsoring my presence in the building just said I could share his login. "The password is Apr1999!, if you happen to be the first one to log in when it expires, just change it to May1999! and so on, alright?" It satisfied the uppercase, lowercase, number, symbol, and non-reuse criteria perfectly, while having precisely zero security. Come to find out, something like a dozen different contractors were all sharing this one guy's login. He was the only reason anything got done in the whole region. The "system", such as it was, worked, but it made a mockery of corporate IT. A few months into the project, that employee gave his notice and quit. Went to work for the competitor across the street; we'd bump into each other at the diner and stuff. But they couldn't just turn off his login -- his manager understood that all the contractors were using it, so they just left it active, and whoever got the expiry prompt would dutifully update the password every month...
    - SkyBelow 7y ago
      >but it made a mockery of corporate IT. Isn't corporate IT recursively defined as being a mockery of corporate IT?
    - PeterisP 7y ago
      If you make the system secure but unusable, the users will find a way to make it usable but insecure.
      - heavenlyblue 7y ago
        But changing the password every month doesn’t make it any more secure. Passwords don’t really have an expiration date if they are secure (as in long enough and not reused) in the first place.
  - t34543 7y ago
    Why would you get reported?
- scrooched_moose 7y ago
  I use very secure passwords (32 character random) basically everywhere except for work because they are so aggressive about password rotation. Work gets the equivalent of Banana1!, Banana2@, Banana3#....Banana9(, Banana1! (upper case, lower case, number, symbol, can't be previous 8 passwords) because we rotate constantly.
LegitShady 7y ago
DROP TABLE
makecheck 7y ago
That seems like a system where the “password” `rm -Rf /` would...run.

y4mi 7y ago

Just use an ultra secure password schema such as September2019@$ . They obviously want you to use it considering that policy

martin_a 7y ago
Same here. Using a base password and adding the month in which I changed it the last time. If somebody feels happy about that, so be it.
Twisell 7y ago
I once tried Password1 scheme as a form of protestation for a client corp account I'd connect every 2 month or so but that had a 1 month rotation policy (so that I actually had to change my password every time I connected to them). It worked... Obviously I changed it to something else but regularly tried if still worked. The big payout was when we had an on-site formation from a third party and the teacher needed to create a corp account. He miserably failed to validate various secure combinations against policy (like 16+ length 5 words xkdc style). Being the only consultant associated, I just yelled across the room full of in-house IT guys "Just try Password1 it's gonna make it!" Obviously it worked out ¯\_(ツ)_/¯ PS: Oh and nobody reported me for this "incident" I still don't know if it's out of shame, dumbness or because nobody wanted to actually get to work to change that policy.
- myself248 7y ago
  Oh yeah. Yeeeears ago, I was contracting for a telecom provider, and as a contractor, the process for getting logins to all the stuff I needed access to was onerous in some cases, nonexistent in others. So the employee who was sponsoring my presence in the building just said I could share his login. "The password is Apr1999!, if you happen to be the first one to log in when it expires, just change it to May1999! and so on, alright?" It satisfied the uppercase, lowercase, number, symbol, and non-reuse criteria perfectly, while having precisely zero security. Come to find out, something like a dozen different contractors were all sharing this one guy's login. He was the only reason anything got done in the whole region. The "system", such as it was, worked, but it made a mockery of corporate IT. A few months into the project, that employee gave his notice and quit. Went to work for the competitor across the street; we'd bump into each other at the diner and stuff. But they couldn't just turn off his login -- his manager understood that all the contractors were using it, so they just left it active, and whoever got the expiry prompt would dutifully update the password every month...
  - SkyBelow 7y ago
    >but it made a mockery of corporate IT. Isn't corporate IT recursively defined as being a mockery of corporate IT?
  - PeterisP 7y ago
    If you make the system secure but unusable, the users will find a way to make it usable but insecure.
    - heavenlyblue 7y ago
      But changing the password every month doesn’t make it any more secure. Passwords don’t really have an expiration date if they are secure (as in long enough and not reused) in the first place.
- t34543 7y ago
  Why would you get reported?
scrooched_moose 7y ago
I use very secure passwords (32 character random) basically everywhere except for work because they are so aggressive about password rotation. Work gets the equivalent of Banana1!, Banana2@, Banana3#....Banana9(, Banana1! (upper case, lower case, number, symbol, can't be previous 8 passwords) because we rotate constantly.

LegitShady 7y ago

DROP TABLE

makecheck 7y ago

That seems like a system where the “password” `rm -Rf /` would...run.