3 ms·
> changes once or twice a year Please stop cargo culting this.
by stouset 3y ago
> changes once or twice a year
Please stop cargo culting this.
- BrandoElFollito 3y agoCould you please expand your thought?
- deleted 3y ago[deleted]
- EE84M3i 3y agoNIST says: > “Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.” They also don't recommend having rules about like, a certain number of symbols, etc. https://pages.nist.gov/800-63-FAQ/#q-b05 https://pages.nist.gov/800-63-FAQ/#q-b05
- tnbp 3y agoYou should not require users to change their passwords periodically, as this will piss them off and make them use many weak passwords rather than one strong password. Only require a password change when there is reason to believe their old password has been compromised.
- px43 3y agotnbp nailed it To explain the other side of the comment, "cargo cult security" refers to some groups of tribal people in New Guinea who build giant wooden airplanes and control towers in the hopes of attracting airplanes delivering food[1][2]. It's very common in the security space for people who have zero understanding of underlying security models to build elaborate structures that kind of look like and feel like they're doing security, but it's actually providing no value. These practices get blindly passed on for decades despite all the best effort of actual experts to explain to them why the practices are, in fact, completely useless. Password rotation is a mindbogglingly persistent one, as described in the other comment. [1] https://www.youtube.com/watch?v=qmlYe2KS0-Y https://www.youtube.com/watch?v=qmlYe2KS0-Y [2] https://en.wikipedia.org/wiki/Cargo_cult https://en.wikipedia.org/wiki/Cargo_cult