3 ms·
> Mandatory password change intervals. Hasn't been best practice for a decade. > Insane rules for constructing passwords. There needs to be a minimum standar
by bongodongobob 2y ago
> Mandatory password change intervals.
Hasn't been best practice for a decade.
> Insane rules for constructing passwords.
There needs to be a minimum standard. Generally length is enough, but the special character type stuff is annoying.
> Completely undocumented password requirements that you just have to figure out by trial and error.
I haven't come across this.
> Complicated error messages full of security jargon. "Secret Questions" that you can't remember the answers to.
That's a you problem.
Y'all complain about password breaches but want to use Mypassword69! for everything. Pick a lane.
- smohare 2y agoI encounter some bogus undocumented password constraints probably half the time I create an account. Usually it is a maximal length requirement that is not mentioned in the error message. Don’t defend these idiotic practices.
- bongodongobob 2y agoI'm not. The only time I've seen a maximum length password was like 10 years ago on Dell's IDRAC I think? I just don't think the complaints being thrown out here are good arguments.
- tsimionescu 2y agoLook at Microsoft's personal accounts (live.com or whatever they are calling it this week) - they still have this limit.
- pasquinelli 2y agoi just had it happen day before yesterday to create an account for a service to do a background check for a new job. it rejected my password without saying why and i could only get past it by shortening it to 15 characters. and then the deeper question is, why do i need to create an account for this?
- bongodongobob 2y agoNot defending the max length, that's stupid and probably some old AS400 thing that got built into the system, but the account is for auditing obviously.
- pasquinelli 2y agoi don't see what's obvious. what is being audited? why is my email address needed when i'm giving them my id and ssn?
- pasquinelli 2y agopassword too long is such a stupid reason to reject a password
- troupo 2y ago> but want to use Mypassword69! for everything That... That is literally what these "security practices" force you to use. You literally used an example of the ubiquitous "at least one uppercase letter, one special character, and one digit" requirement
- bongodongobob 2y agoAnd I think that's fine. Unless you're going to ask for 24 character passwords. Pick one.
- maratc 2y agocorrecthorsebatterystaple is 25 characters though.
- gpvos 2y ago> Hasn't been best practice for a decade. This entire thread is about places that clearly have no clue about best practices. > I haven't come across this. You sweet summer child...