4 ms·
Every company I work at requires regular rotation and other idiotic rules which lead people to choose demonstrably weaker passwords. My company refuses to liste
by sgustard 5y ago
Every company I work at requires regular rotation and other idiotic rules which lead people to choose demonstrably weaker passwords. My company refuses to listen to reason and accuses us of trying to subvert security when we point out their antiquated process. What do you recommend?
- deleted 5y ago[deleted]
- Biganon 5y agoI recommend not working for a company that thinks its own employees are trying to subvert security. What level of trust is that?
- dragonwriter 5y agoThe level of trust justified by pretty much all of security research; the insider risk is by far the biggest security risk for most organizations, whether you are talking about physical loss or infosec.
- spc476 5y agoTry quoting from the government standard, NIST Special Publication 800-63b, section 5.1.1.2, which states: “Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically).”
- pitaj 5y agoMy company is the same way. I've even quoted NiST recommendations, but they say that ISO standards require it. Ugh
- snow_mac 5y agoThis is why things like MarchPassword2022! comes about ... not that I've ever used that password...
- benhurmarcel 5y ago> What do you recommend? Increment a digit at the end of your password and stick the current digit on a post-it below your monitor, like everyone does. Then get on with real work.