4 ms·
I think I like this idea that the rotation interval could be made proportional to length, for example doubling the interval with each additional character. Secu
by manwe150 1y ago
I think I like this idea that the rotation interval could be made proportional to length, for example doubling the interval with each additional character. Security standards already now acknowledge that forced yearly rotation is a net decrease in security, so this would incentivize users to pick the longest password for which they would tolerate the rotation interval. Is yearly rotation too annoying for you? For merely the effort of going from 12 -> 14 characters, you could make it 4 years instead, or 8 years, 16, and so on.
- connicpu 1y agoCan confirm when I found out I'd be required to regularly change my password the security of it went down significantly. At my current job when I was a new employee I generated a secure random password and spent a week memorizing it. 6 months later when I found out I was required to change it, I reverted to a variation of the password I used to use for everything years ago with some extra characters at the end that I'll be rotating with each forced change...
- byproxy 1y agoWhy not make use of a password manager?
- Aeolun 1y agoYou can’t open the password manager until your computer is unlocked.
- isomorphic- 1y agoYou can put the password manager on your phone or another device.
- denkmoon 1y agoand now you’re violating a different policy.
- connicpu 1y agoI'm not pulling my phone out every time I have to unlock my computer at work. If IT wants my work account to be secure they should change their policies.
- edoceo 1y agoAs discussed here, the policy is from outside the org.
- jimmaswell 1y agoI do the same but write the number at the end of the password on the laptop in sharpie. I work from home so I've been thinking about making a usb stick that simulates a keyboard with a button to enter the password.
- immibis 1y agoDangerous. You might accidentally press the button in a group chat.
- 3eb7988a1663 1y agoThey would then have an excuse to get one of those mission control button covers.
- butshouldyou 1y agoUnfortunately, lots of end users refuse to read the password policy and won't understand why their password reset interval is "random" or shorter than their colleague's.