5 ms·
We are still waiting on compliance standards to update their password change policies to reflect what most people have been saying for over a decade, that frequ
by briffle 3y ago
We are still waiting on compliance standards to update their password change policies to reflect what most people have been saying for over a decade, that frequently changing passwords are a security risk..
- kibwen 3y agoNIST itself has been actively discouraging password rotation since 2016: https://pages.nist.gov/800-63-3/sp800-63b.html#memorizedsecrets https://pages.nist.gov/800-63-3/sp800-63b.html#memorizedsecr...
- rjzzleep 3y agoBut then how will Cyberark make money?
- Arrath 3y agoI expect you have 3M lobbying on the other side of the issue in the interest of post-it sales.
- dmvdoug 3y agoI am so sending this to our district IT people the next time they make us change our passwords at school.
- jwestbury 3y agoNIST discourages it, but most of the US government still requires it. In fact, I used to have a 60-day password rotation policy with such brilliant requirements as "no more than three characters of one class sequentially." I soon realised that "ShitFuck!", thus, was a valid password -- and off I went. Meanwhile, a teammate who had previously been a technical writer contracting with the NSA told of the "waterfall method" -- not of software developments, but of passwords. It was common in his world, apparently, and you could always hear he was typing his password by the staccato of QazWsxEdc123, etc.
- justsomehnguy 3y agoIt's always amuses me what a domain name with a number in it ticks '3 of 4'.
- rwmj 3y agoThe PCI-DSS website itself requires that you change password every 12 months. At the same time the period for recertifying PCI-DSS is ... every 12 months. I have a systematic way to create a new password each time, which probably isn't secure.
- geraldwhen 3y agoI have to rotate my password at work every 3 months. Without a system, it wouldn’t be sustainable.
- junon 3y agoGot into a quarrel about this with our IT director at a previous company. I wish there was a security best practices FAQ I could link to for this sort of stuff.
- placatedmayhem 3y agoAs a peer post of yours pointed out, NIST changed guidance to discourage password changes years ago: https://pages.nist.gov/800-63-3/sp800-63b.html#memorizedsecrets https://pages.nist.gov/800-63-3/sp800-63b.html#memorizedsecr...