Reminds me of the first job of my career. We had a 30-day password reset policy enforced by Active Directory group policy. I couldn't have told you what rules

Reminds me of the first job of my career. We had a 30-day password reset policy enforced by Active Directory group policy. I couldn't have told you what rules were required to get the system to accept the password, but it well beyond the default/typical AD policy[0]. To "enhance security", ours included a requirement that none of the prior 10-or-so passwords could be used, had a 12-character minimum[1] which IIRC, required also setting the "Store passwords using reversible encryption[2]". We allowed 30 bad logins, but a good login had to occur before lock-out or it required tech staff intervention. We would have been better off having a non-resetting password policy with a reasonable minimum length. For the first 9 months of my career, I was top-tier end-user support[3]. It took about 2-months before I stopped asking people for passwords. 95% of the time, the password was "MonthNameYearNumber!!!!" with bangs filling in the rest, i.e. "March19991!!!!!!!!", or some variation. However, the frequency with which it was exactly that pattern was amazing. So that gave me 12 tries to get a password. I rarely locked out an account. As is usually the case ... there's a law of unintended consequences. People will seek to reduce the friction to getting their job done and aren't great at assessing risk. In addition, the risk to an individual password is low. Even the result of a successful breach of a user's password is often not devastating to the individual who was attacked when that password is a LAN login (chances are you're not storing your own personal financial information on your work PC). One of the odder unintended consequences -- figuring out the appropritae incantation to generate an acceptable password for the system was ... way more difficult than it should have been. I'm fairly certain one of our security tools was just broken. We had something that applied far more strict rules about password history than what AD could enforce, looking specifically for people using patterns, along with some other odd ones, like "you cannot repeat the same character", so "umbreLLa" was rejected. They, literally, reduced the number of possible passwords that a brute-force attack would require. There was an interesting bug there -- we discovered that after the account was created, if only one password was in the password history, it would pretty much refuse to allow any password that didn't contain half of the characters, in the same place, as the prior password. Then, future required password resets would refuse all passwords that were similar to the previously rejected ones which were used on that account. However, if you used one of those rejected passwords on an account that hadn't had them rejected on that first reset, they would be allowed for that user. I'm guessing they reversed a boolean somewhere (no similar past passwords) and that the security software stored a history of rejected passwords for future validation (no idea why this would be done, but then, no idea why it'd be illegal to duplicate characters), but security ditched all of those products when AD was upgraded and the tools stopped working. I know one of the reasons for the odd password rules were that we synced passwords to the Mainframe accounts, and they had a set of nonsensical rules that were very similar. [0] If memory serves, default was 10 bad passwords before 1 hour lock-out, password had to have at least one number, one lower-case and one upper-case letter with an 8-character maximum and 90-day reset. [1] I believe there's a study or two that indicates somewhere around 7-10 is typical for what a person can memorize easily. I've always wondered why. In my childhood, memorizing a 7-digit or 10-digit phone number for several people was something everyone did, so it's arguable that people my age have that ability out of necessity. I wonder what would be found if that were re-done, today, with people who are too young to remember days before speed-dial. Maybe it has been: https://abcnews.go.com/Technology/brain-memory-magic-number/story?id=9189664 https://abcnews.go.com/Technology/brain-memory-magic-number/... [2] This sounds horrifying when thinking about passwords in today's terms, but storing as a password hash resulted in storing a Lan Manager Password hash which is very low quality (fairly certain this is moderately improved in later versions of AD but is still able to be enabled). [3] I remember joking that we were helpdesk staff without phones; our "ticket system" was voicemail/e-mail. Basically, if the helpdesk couldn't solve it over the phone, we arrived at a cubicle, often with a screw-driver. edit: bumped tab and accidentally hit "enter" for a newline ... submitting before I was done :(