13 ms·
Our IT did the exact same thing with expiring m365 passwords. They weren’t using the corp domain, typos all over and the URL was obscured using a bizarre link s
by lobochrome 3y ago
Our IT did the exact same thing with expiring m365 passwords. They weren’t using the corp domain, typos all over and the URL was obscured using a bizarre link shortener.
The same guys also force us to change our passwords every 6 months and block the last twenty. Passwords we have to enter in systems that can’t pull directly from password managers and thus have to type 10-20 per day. Guess the average strength of an employee password!
I think IT incompetence should lead to audit fails or even better delisting from exchanges.
- jraph 3y ago> The same guys also force us to change our passwords every 6 months and block the last twenty It's good we have 26 letters, that comfortably leaves you a margin of 6 combinations :-)
- pjc50 3y ago> I think IT incompetence should lead to audit fails or even better delisting from exchanges. Fear of policy is why you get things like "force us to change our passwords every 6 months and block the last twenty". Getting a central arbiter of IT competence is a hard problem.
- Thorrez 3y agoIs blocking the last 20 passwords a bad thing? I agree the other stuff is bad, but to me, that part doesn't seem bad.
- pama 3y agoEven if this rule technically seems benign, together with the forced change it encourages users to game the system leading to predictable patterns, eg adding a rotating letter or digit combo at the end of a same password.
- Thorrez 3y agoIs that worse than the password without the rotating letter/digit?
- pflenker 3y agoIt leads to less security as it is more likely that the new password will just be an old one with an incremented number at the end.
- cobbaut 3y agoAnd unless there is a minimum password age some people will just change it 20 times and then back to the same password.
- Workaccount2 3y agoMyself and most people keep our login passwords written on paper in our desk because of this stupid practice. Can't use previous passwords and new password every 90 days. This is on top of 2FA.
- thesuitonym 3y agoThe worst part is it actually leads users to boasting about how they `beat the system', essentially telling their coworkers what their pattern is, making the password easier to guess.
- macintux 3y agoI have long felt that organizations that require password rotation for employees should, when the users are changing their passwords, record and post the old password to an internal site (without any identification of the user) for educational (and mockery) purposes.
- Thorrez 3y agoThat will help attackers. People often make passwords similar to their old passwords. A machine learning model could be trained on this list.
- Thorrez 3y agoAre you saying that "old one + number" is less secure than "old one"? That doesn't sound right.
- meindnoch 3y agoForced password updates are a bad thing. If your company does forced password updates, they are not following the NIST recommendation: https://pages.nist.gov/800-63-FAQ/#q-b05 https://pages.nist.gov/800-63-FAQ/#q-b05 If your company is not following the NIST recommendation, they are incompetent, and will be held liable in case of a breach.
- ixwt 3y agoThe company I work for had a ransomware issue, so they got more zealous about security. They require us to change our passwords every 45 days now. When I pointed out the NIST recommendations of not rotating passwords, they say they are following the guidance of the response team that helped them recover from the ransomware. And that the NIST doesn't actually deal with the real world.
- b112 3y agoIf your company is not following the NIST recommendation, they are incompetent, and will be held liable in case of a breach This is a stretch. Liable? Please show the case law, or the legislation. (My statement has no relevance to the validity of NIST's recommendations)
- bluGill 3y agoNot directly. However NIST is admissible in court and so if someone sues there is now evidence that they should have known better.
- b112 3y agoAnything is admissible in court, the judge merely has to allow it. There are 1000s of such organizations, and many conflict with each other. My point is, it's inaccurate to say you are liable for not following NIST. I could easily say you could be liable, for not following me. Does that make it so? No.
- SAI_Peregrinus 3y ago
- alistairSH 3y agoIn combination with forced changes, it leads to… Password1 Password2 Password3 Etc
- bluGill 3y agoI'm closing in on password100... It is the only sane thing to do, a good password is hard to memorize. (passphrases are must better, but hard to type correctly first thing in the morning and take too long when I need to type my password a dozen times a day)
- pierat 3y agoThe one I see that stays updatable is: PasswordFebruary2024! Where month and year update on the date of forced password change.
- alistairSH 3y agoOh, that's a good one. <runs off to update corporate logins>
- Karellen 3y agoITYM hunter3 hunter4 hunter5
- Thorrez 3y agoIs that worse than Password1 Password1 Password1 Etc?
- swozey 3y agoI mean it's great for 99% of your passwords and pretty much forces people into using randomized generated passwords.. but I still have to remember at least ONE password by heart. Whether it's 32 characters or 16 or what not, I still need SOME way to get into my password manager to even get to my passwords. So what, I'm going to make my password tacokissies69 and.. what, add a 0 every 6 months so I pass the 20 password minimum? So a hacker can infer that my password is tacokissies69000 of some sort..
- Thorrez 3y agoI'm not really sure how this problem is related to banning using identical passwords as past passwords.
- swozey 3y agoI forget who puts that stuff out NIST/STIG(?) but IIRC in the recent few years they determined that rotating passwords like that was basically security theater and wasn't worth the damage to the staffs productivity
- user3939382 3y agoNIST, whose guidelines, somehow, even other federal departments and agencies usually don’t follow. NIST has very good password complexity and management guidelines. Just USE THEM! It’s not that hard! How do you have billion dollar companies that can’t RTFM.
- bluGill 3y agoNIST whose guidelines are admissible in court and a competent judge will take over expert testimony. (an expert witness who says something that contradicts these guidelines is guilty of perjury, though good luck persecuting that)
- Zak 3y agoPerjury is lying under oath, not disagreeing with government guidelines.
- bee_rider 3y agoOn one hand, I agree that just disagreeing with a guideline isn’t perjury. Especially in a case like this where lots of the industry still uses the old (bad, imo) plan. On the other, an expert witness has specifically represented themselves to be an expert. Is there any level of incompetence that raises to the level of perjury in that case? IMO there ought to be.
- dmorgan81 3y agoThat would be argued in cross-examination. A witness can be shown to be not a good witness. Perjury is very specific to knowingly lying while testifying under oath. We really don't want to expand it to areas of ignorance or disagreement; that way would stop people from testifying entirely.
- danaris 3y ago> The same guys also force us to change our passwords every 6 months While I know this may be fruitless, it might be worthwhile to point out to them that the official guidance from NIST and similar organizations is now not to do this. The IT department where I work required yearly password changes up until I brought this change to their attention, at which point they changed to simply recommending a password change if you have reason to believe it might have been compromised.
- gnfargbl 3y agoThe lack of use of a non-corp domain, the typos and the use of shortened links does sound like a form of incompetence, probably at the management layer. However, the password rotation requirement was until relatively recently something that many IT auditors would actually recommend, even though it leads directly to bad user password choices. In fact I wouldn't be at surprised to learn that was still the case in a lot of places.
- bluGill 3y agoFortunately NIST has specific advice that recommends against that which is admissible in court (in the US). I'm not sure how to work through the bureaucracy to do this, but your company should sue them in court for incompetence to get their money back.
- Kye 3y agoI've seen multiple accounts from IT/security people who discovered something like "this could get the company in legal trouble" with links to details was exactly what got an otherwise intractable issue resolved.
- flatline 3y agoTwo then-current NIST standards (62 and 71?) side by side gave contradictory advice. It is a step forward though for sure.
- k8svet 3y agoYeah, define recently.
- homeyKrogerSage 3y agoIt is. I work as an IT tech at a military defense contractor and they require regular recycling passwords, with a decent number of passwords remembered. They at least have complexity requirements applied so not 100% bad, but still archaic
- withinboredom 3y ago
- M95D 3y ago> have to type 10-20 per day Same problem here. My solution: Get a mouse with internal memory for macros, such as Natec Genesis GX78 (old, no longer available, but this is an example). Program your new password on one of the unused mouse buttons or in a different profile. Use the mouse to type the password.
- reaperman 3y agoMight be a good product to app-ify. Maybe a USB dongle that acts like a keyboard and controlled by your phone. Give it some sort of 1Password / Bitwarden integration. Could make it double as a YubiKey. Surely this exists already?
- f3d46600-b66e 3y agoYubikey supports this already, but without the phone part.
- mikepurvis 3y agoI should do this for ssh password entry. Running ssh-agent is still 90% of the story, but it comes up often enough that I'm on a terminal in a remote machine or inside a screen session or something that it would still be awfully useful to be able to just autotype it.
- reaperman 3y agoDoes it require installing 3rd party software on the host machine? This might not work great for this kind of "shadow IT" application in all environments, whereas one that acts as a USB keyboard might be more versatile.
- organsnyder 3y agoOnly to configure it. It presents as a USB keyboard (among other device types).
- abustamam 3y agoI had a similar experience at an old company that used M365. YMMV but with Bitwarden I generate passphrases like Pregnant-Guppy-Skateboard9 and it made it tons easier for me to type 20x a day than &7UoTod#$7OOD
- aaronharnly 3y agoMy work password now has an "18" embedded somewhere in the middle of it thanks to my autoincrement approach to handling that kind of obnoxious policy. Then I became CTO and retired the policy to align to modern NIST recommendations, so that "18" is in there forever :)
- WorldMaker 3y agoI've noticed that Microsoft themselves aren't helping this right now. M365 seems to default to using random-tenant-guid.onmicrosoft.com for a lot of these transactional emails like password changes even though the official account.microsoft.com is fully multi-tenant aware and most Microsoft guidance tells you to always go directly to account.microsoft.com. These transactional email mistakes seem like another case of Microsoft accidentally exposing problems in their org chart to external customers. I imagine it has something to do with the wild rewrites from old Azure AD to new "exciting brand" Entra ID and other such shenanigans combined with Microsoft's willingness to bend over backwards to bad IT administrators and letting them set bad defaults (such as "just us the .onmicrosoft.com GUID instead of a real domain"), because companies love to pay them good money for the "control" to do stupid things in Group Policies and corporate configuration. Combined with the fact that the largest single source of spam I'm seeing right now is also coming from random tenant GUIDs .onmicrosoft.com (is Azure really missing that much SMTP security for random M365 tenants?) and this sort of corporate anti-training users to follow bad transactional email links, it certainly feels like we are in a perfect storm of M365 phishing.
- Fogest 3y agoThe whole Microsoft Office suite online just feels like hacky code on top of more hacky code. And combine with how your account can also be signed into your PC, and then also signed into applications. I have a work email, and two personal emails that all make use of Microsoft products. What a mess it is managing the accounts and the different systems. The business emails and accounts just seem sloppy and seem to work different than personal accounts. Overall when compared to Google's suite of products, M365 just seems so sloppy.
- dimask 3y agoAdd to this the different varieties of their apps. The whole MS thing is a mess imo also because it cannot decide if it is for enterprise or for personal use. Some colleagues had to reinstall outlook, and after that things did not work properly. What actually happened was that they had googled and downloaded "outlook" from microsoft's website, instead of installing the m365 suite version. Which is basically a different application or version or whatever, but sharing the same name and app icon.
- iamthirsty 3y agoThe Walt Disney Company did exactly this when I was there, and everyone dreaded it. Did nothing but waste time.
- dimask 3y ago> Guess the average strength of an employee password! It is interesting how sometimes creating "more secure" measures results on less security. Our IT department decided that using 2fa for vpn is not enough, we should also extra 2fa for connecting to the webmail even through intranet or vpn. Guess who stopped using the vpn. Meanwhile, one can set up and use our email through any email client app on desktop or mobile without any 2fa at any step. Go figure.