3 ms·

Yeah, I think there's value in it, but if you don't have a way to prevent "plus one passwords", it probably isn't super effective anyways. It may be a case wher

Yeah, I think there's value in it, but if you don't have a way to prevent "plus one passwords", it probably isn't super effective anyways. It may be a case where frustrating the user four times a year isn't worth it... maybe just frustrating them once a year will lead people to put more effort into making their passwords suitably different.

qw3rty01 6y ago
There definitely is value in it if users created proper passwords, but path of least resistance tends to win out in the end, and people will just find ways around the mechanisms to prevent weaker derived passwords.
csours 6y ago
"A friend" used to have the password set to the 3 character month name + the month ordinal + "!" - MarMar04! We were required to change passwords once a month, and not re-use any of our last 6 passwords.
- letitbeirie 6y ago
  My "friend" doesn't use this system anymore, but passwords along the line of '1stQuarter2001!' worked for well over a decade of being required to change passwords 4 times a year.
- rightbyte 6y ago
  Nice! My friend rotate through 3 digits to be able to guess it quicker when he forgets which digit it is. This solves it.
- baobabKoodaa 6y ago
  Am I the only one bothered by month ordinal 04 assigned to March, which is the 3rd month? This sounds almost like Java's infamous Date class that assigned month ordinal 2 for March, except somehow we've managed to make the off-by-one error in the other direction :D
GordonS 6y ago
Four times a year? I've had to change mine once a month for the past 20 years. Needless to say, I increment a numeric suffix that wraps around every 10 or so months. It has always seemed like a totally pointless exercise. I can see potential value for service accounts, as long as you have automation in place to change them where needed - but for user accounts, it's complete madness.
- marcosdumay 6y ago
  Hum... I have never seen any place that implemented password rotation for the users and didn't exempt service accounts. And the security solution sellers I've talked to are all either on the position of "yeah, password rotation is incredibly important, but you can't rotate service accounts" or "yeah, I know you don't rotate the password of service accounts (no need to tell me), here's a tool to reduce the risk this causes".
  - ocdtrekkie 6y ago
    Microsoft's approach now is to recommend using Managed Service Accounts, which is an Active Directory feature in modern Windows servers. They rotate their own passwords through some sort of magic. That being said, plenty of janky old Windows apps won't work with them anyways.
  - GordonS 6y ago
    Place I work started rotating service account passwords around a year ago, using automation built in to some super expensive PIM (Privileged Identity Management) system.
    - marcosdumay 6y ago
      Just to complement, so next time I can say I heard about one place on the internet... Does your workplace require password rotation for personal users?
      - GordonS 6y ago

qw3rty01 6y ago

There definitely is value in it if users created proper passwords, but path of least resistance tends to win out in the end, and people will just find ways around the mechanisms to prevent weaker derived passwords.

csours 6y ago

"A friend" used to have the password set to the 3 character month name + the month ordinal + "!" - MarMar04! We were required to change passwords once a month, and not re-use any of our last 6 passwords.

letitbeirie 6y ago
My "friend" doesn't use this system anymore, but passwords along the line of '1stQuarter2001!' worked for well over a decade of being required to change passwords 4 times a year.
rightbyte 6y ago
Nice! My friend rotate through 3 digits to be able to guess it quicker when he forgets which digit it is. This solves it.
baobabKoodaa 6y ago
Am I the only one bothered by month ordinal 04 assigned to March, which is the 3rd month? This sounds almost like Java's infamous Date class that assigned month ordinal 2 for March, except somehow we've managed to make the off-by-one error in the other direction :D

GordonS 6y ago

Four times a year? I've had to change mine once a month for the past 20 years. Needless to say, I increment a numeric suffix that wraps around every 10 or so months. It has always seemed like a totally pointless exercise. I can see potential value for service accounts, as long as you have automation in place to change them where needed - but for user accounts, it's complete madness.

marcosdumay 6y ago
Hum... I have never seen any place that implemented password rotation for the users and didn't exempt service accounts. And the security solution sellers I've talked to are all either on the position of "yeah, password rotation is incredibly important, but you can't rotate service accounts" or "yeah, I know you don't rotate the password of service accounts (no need to tell me), here's a tool to reduce the risk this causes".
- ocdtrekkie 6y ago
  Microsoft's approach now is to recommend using Managed Service Accounts, which is an Active Directory feature in modern Windows servers. They rotate their own passwords through some sort of magic. That being said, plenty of janky old Windows apps won't work with them anyways.
- GordonS 6y ago
  Place I work started rotating service account passwords around a year ago, using automation built in to some super expensive PIM (Privileged Identity Management) system.
  - marcosdumay 6y ago
    Just to complement, so next time I can say I heard about one place on the internet... Does your workplace require password rotation for personal users?
    - GordonS 6y ago