4 ms·
NIST itself has been actively discouraging password rotation since 2016: https://pages.nist.gov/800-63-3/sp800-63b.html#memorizedsecrets https://pages.nist.gov/
by kibwen 3y ago
NIST itself has been actively discouraging password rotation since 2016: https://pages.nist.gov/800-63-3/sp800-63b.html#memorizedsecrets https://pages.nist.gov/800-63-3/sp800-63b.html#memorizedsecr...
- rjzzleep 3y agoBut then how will Cyberark make money?
- Arrath 3y agoI expect you have 3M lobbying on the other side of the issue in the interest of post-it sales.
- dmvdoug 3y agoI am so sending this to our district IT people the next time they make us change our passwords at school.
- jwestbury 3y agoNIST discourages it, but most of the US government still requires it. In fact, I used to have a 60-day password rotation policy with such brilliant requirements as "no more than three characters of one class sequentially." I soon realised that "ShitFuck!", thus, was a valid password -- and off I went. Meanwhile, a teammate who had previously been a technical writer contracting with the NSA told of the "waterfall method" -- not of software developments, but of passwords. It was common in his world, apparently, and you could always hear he was typing his password by the staccato of QazWsxEdc123, etc.
- justsomehnguy 3y agoIt's always amuses me what a domain name with a number in it ticks '3 of 4'.