5 ms·

> Employees often view security protocols as cumbersome. Long, complex passwords, frequent logins and multi-step authentication can feel like barriers to produc

> Employees often view security protocols as cumbersome. Long, complex passwords, frequent logins and multi-step authentication can feel like barriers to productivity. This resonates. Juggling Okta and 1P a few times a day is a drag

bawolff 2y ago
I think in the security industry, password complexity requirements and frequent re-logging in have been considered bad practises for a while now. Alas they are still seen in places.
- masklinn 2y ago
  > frequent re-logging We recently had to add that for $bigco requirements at $dayjob, I was stunned: they asked to log people out after — IIRC — 1h inactivity.
  - zdragnar 2y ago
    That's a not-uncommon "security" feature $bigco will add as a requirement for buying software as well. Honestly, it's not a terrible policy if you're working with privileged information. A contact mine had with a big insurance company required a 30 minute inactivity logout I think. OTOH if your job is filling out spreadsheets and forms for a retailer and you don't even have access to customer info, it's way overkill. Nuance tends to be the first thing tossed out the window when dealing with $bigco though, too many people to manage smartly.
  - MattPalmer1086 2y ago
    Logging out when there is no activity is quite a common security control requirement in many places. I've seen 15 minute inactivity log out quite frequently. Drives users mad of course (particularly admins who are logged in to many machines).
    - masklinn 2y ago
      Device logout makes perfect sense, but this is software logout, so would be in addition to the device one, in every piece of software. I hope and assume it goes along SSO making it less painful but still…
- GoblinSlayer 2y ago
  Famously, Jira.
sverhagen 2y ago
Yes, everything is downhill from the convenience. It's the most basics of things, if there's friction or obstacles, people will go around. And, boy, do companies put up some obstacles: Does your Intranet site not work with my password manager? Do I have to carry a hardware token generator with me, everywhere I go? Do I need to use an arcane VPN technology to get to your company-approved tool? Are you still making me rotate passwords every six weeks? Are you still making me use bad p@ssword$123 with outdated password policies? Are you logging me out of email every four hours to cycle me through the multi-step login process, even though I'm on a secured-by-you company device?

bawolff 2y ago

I think in the security industry, password complexity requirements and frequent re-logging in have been considered bad practises for a while now. Alas they are still seen in places.

masklinn 2y ago
> frequent re-logging We recently had to add that for $bigco requirements at $dayjob, I was stunned: they asked to log people out after — IIRC — 1h inactivity.
- zdragnar 2y ago
  That's a not-uncommon "security" feature $bigco will add as a requirement for buying software as well. Honestly, it's not a terrible policy if you're working with privileged information. A contact mine had with a big insurance company required a 30 minute inactivity logout I think. OTOH if your job is filling out spreadsheets and forms for a retailer and you don't even have access to customer info, it's way overkill. Nuance tends to be the first thing tossed out the window when dealing with $bigco though, too many people to manage smartly.
- MattPalmer1086 2y ago
  Logging out when there is no activity is quite a common security control requirement in many places. I've seen 15 minute inactivity log out quite frequently. Drives users mad of course (particularly admins who are logged in to many machines).
  - masklinn 2y ago
    Device logout makes perfect sense, but this is software logout, so would be in addition to the device one, in every piece of software. I hope and assume it goes along SSO making it less painful but still…
GoblinSlayer 2y ago
Famously, Jira.

sverhagen 2y ago

Yes, everything is downhill from the convenience. It's the most basics of things, if there's friction or obstacles, people will go around. And, boy, do companies put up some obstacles: Does your Intranet site not work with my password manager? Do I have to carry a hardware token generator with me, everywhere I go? Do I need to use an arcane VPN technology to get to your company-approved tool? Are you still making me rotate passwords every six weeks? Are you still making me use bad p@ssword$123 with outdated password policies? Are you logging me out of email every four hours to cycle me through the multi-step login process, even though I'm on a secured-by-you company device?