2 ms·
Microsoft has been saying this since before FTA, but nobody seems to have told corporate IT. When I was there (2015-2019), we had to change our passwords every
by pianoben 6y ago
Microsoft has been saying this since before FTA, but nobody seems to have told corporate IT. When I was there (2015-2019), we had to change our passwords every six months.
- lucb1e 6y agoSecurity consultant here - I put it in many of our reports (whenever we notice such a policy). They're not exactly changing course just yet, but we do try to communicate the good news where relevant. Also to avoid complexity requirements ("you don't have any digits in correct horse battery staple, that cannot be secure!") but to use a blacklist and length requirement instead, as recommended by NIST and NCSC (hopefully other countries will follow suit).