3 ms·
If all software automatically changed its own admin password after 121 days, and refused to set old passwords (store the last 5 salted hash), that might be a go
by peterwwillis 7y ago
If all software automatically changed its own admin password after 121 days, and refused to set old passwords (store the last 5 salted hash), that might be a good enough stick to force people to rotate passwords themselves, and default passwords would go away.
- Akirus 7y agoAnd users rotate their same "password1", "password2", "password3" passwords every expiration period...
- vectorEQ 7y agoits easy to let them type old password then new password twice, that way u can confirm it's not similar to old password atleast since u receive it in unhashed form from the user themselves.
- peterwwillis 7y agoYeah but you can't do anything about that unless you also enforce complexity. If the goal is to prevent defaults (ex. to prevent drive-bys), the above does that; "good" passwords is a separate requirement.