45 ms·

Four times a year? I've had to change mine once a month for the past 20 years. Needless to say, I increment a numeric suffix that wraps around every 10 or so mo

Four times a year? I've had to change mine once a month for the past 20 years. Needless to say, I increment a numeric suffix that wraps around every 10 or so months. It has always seemed like a totally pointless exercise. I can see potential value for service accounts, as long as you have automation in place to change them where needed - but for user accounts, it's complete madness.

marcosdumay 6y ago
Hum... I have never seen any place that implemented password rotation for the users and didn't exempt service accounts. And the security solution sellers I've talked to are all either on the position of "yeah, password rotation is incredibly important, but you can't rotate service accounts" or "yeah, I know you don't rotate the password of service accounts (no need to tell me), here's a tool to reduce the risk this causes".
- ocdtrekkie 6y ago
  Microsoft's approach now is to recommend using Managed Service Accounts, which is an Active Directory feature in modern Windows servers. They rotate their own passwords through some sort of magic. That being said, plenty of janky old Windows apps won't work with them anyways.
- GordonS 6y ago
  Place I work started rotating service account passwords around a year ago, using automation built in to some super expensive PIM (Privileged Identity Management) system.
  - marcosdumay 6y ago
    Just to complement, so next time I can say I heard about one place on the internet... Does your workplace require password rotation for personal users?
    - GordonS 6y ago
      Yes it does - something like once a month. And every.single.employee is going to be incrementing a numeric suffix, providing no increase to security whatsoever, and annoying the hell out of every.single.employee. Actually, it probably weakens security, since employees will be more likely to have notes of their current password around, since it's difficult to remember the current suffix, since it changes so damn often :/

marcosdumay 6y ago

Hum... I have never seen any place that implemented password rotation for the users and didn't exempt service accounts. And the security solution sellers I've talked to are all either on the position of "yeah, password rotation is incredibly important, but you can't rotate service accounts" or "yeah, I know you don't rotate the password of service accounts (no need to tell me), here's a tool to reduce the risk this causes".

ocdtrekkie 6y ago
Microsoft's approach now is to recommend using Managed Service Accounts, which is an Active Directory feature in modern Windows servers. They rotate their own passwords through some sort of magic. That being said, plenty of janky old Windows apps won't work with them anyways.
GordonS 6y ago
Place I work started rotating service account passwords around a year ago, using automation built in to some super expensive PIM (Privileged Identity Management) system.
- marcosdumay 6y ago
  Just to complement, so next time I can say I heard about one place on the internet... Does your workplace require password rotation for personal users?
  - GordonS 6y ago
    Yes it does - something like once a month. And every.single.employee is going to be incrementing a numeric suffix, providing no increase to security whatsoever, and annoying the hell out of every.single.employee. Actually, it probably weakens security, since employees will be more likely to have notes of their current password around, since it's difficult to remember the current suffix, since it changes so damn often :/