4 ms·
I'll believe it when I see it. I'm still waiting for feds to implement the guidance from https://pages.nist.gov/800-63-3/sp800-63-3.html https://pages.nist.gov
by noasaservice 5y ago
I'll believe it when I see it.
I'm still waiting for feds to implement the guidance from https://pages.nist.gov/800-63-3/sp800-63-3.html https://pages.nist.gov/800-63-3/sp800-63-3.html from 2017 and 2020 about NOT rotating passwords arbitrarily, and NOT requiring undue amount of special symbols.
Even when I've asked IT, I get crickets and more bullshit password rotation.
- earleybird 5y agoMicrosoft followed on with that NIST recommendation and suggested discontinuing regular password changes in 2019 [0]. Where I work (MS infra & service) 90 password changes show no sign of going away. A pretty convincing argument that the folks involved are more into theatre than practice. [0] https://news.ycombinator.com/item?id=26863907 https://news.ycombinator.com/item?id=26863907
- bombcar 5y agoFor a long while you couldn't disable password rotation on Office 365 - you could only set it to some arbitrarily long time (and only via Powershell, if I recall correctly). Luckily that is starting to back off, but it has NOT trickled down everywhere by a long shot.