3 ms·
> they will choose Summer2021 as a password A few years ago when we started implementing the revision of NIST 800-63B we started checking user passwords agains
by tatersolid 5y ago
> they will choose Summer2021 as a password
A few years ago when we started implementing the revision of NIST 800-63B we started checking user passwords against breach lists by hash.
In a company of just a few hundred people, two unrelated employees had chosen exactly the same compromised password. After forcing a change, we asked them what their old password was.
Summer2018! was chosen independently by two people in a smallish company who had never met.
- Godel_unicode 5y agoI did an audit once where security confidently told us that there were no weak passwords given out by the helpdesk. When we actually tested hashes, we determined that there were a ton of the usual suspects. When we chatted up some helpdesk people over lunch, it turned out the problem was that they gave good passwords whenever someone from security asked because otherwise those jerks would scream at you. Everyone else in the company got easy passwords because it lowered call volumes. They literally were checking group membership as part of their reset script and giving the user the type of password which was most likely to get them to go away.
- tatersolid 5y agoYour case has a significant difference: trained IT staff choosing weak passwords for convenience is much worse than “normal” users independently choosing weak credentials despite yearly training. That said, the root cause is the same: humans cannot remember computationally-secure credentials. We need something else. Pushing for “stronger passwords” is folly.