4 ms·
Well I was forced to add password rotation to an enterprise product by a large enterprise user only a couple of years ago despite password rotation being reject
by doctor_eval 4y ago
Well I was forced to add password rotation to an enterprise product by a large enterprise user only a couple of years ago despite password rotation being rejected by research for a decade and no longer recommended even by Microsoft. So, yeah. Like most enterprise stuff it’s all just a bunch of boilerplate.
- Hizonner 4y agoYour opportunity for vengeance on something like that is to have it put up a big warning that says "This setting is dangerous and violates the guidance of the following long list of experts and government bodies: list goes here. Are you SURE you want to take this security risk?". And don't forget to log the insecure configuration every time the system starts up, too.
- DaiPlusPlus 4y agoIf you do that, you'll get dinged in your performance review for being insubordinate.
- doctor_eval 4y agoThis is the germ of a good idea. I don’t do that kind of work any more (building and selling enterprise applications) but I suspect that the way to push back is to have a document they would need to sign that transfers all associated risk to the customer. The people in charge of these companies couldn’t give a shit about research or actual good practice, but dear god they hate taking responsibility for stuff.