3 ms·
Corporate IT still makes you change your password every N months. Tell them to extend the max session length beyond a day and some VP will have an aneurysm.
by paxys 1y ago
Corporate IT still makes you change your password every N months. Tell them to extend the max session length beyond a day and some VP will have an aneurysm.
- al_borland 1y agoIt’s all theater so they can sell the idea that they’re doing everything they can, and if something does happen they can shift blame.
- Freebytes 1y agoIn many cases, it may be to fulfill rules associated with PCIDSS requirements, even if the company never sees the credit card. This all originates from consultants, and the consultants are engaged in security theater.
- jeremyjh 1y agoThere is very little incentive to actually do information security correctly - because hardly anyone can tell if you have - consequently there are very few people who try. It is all just theater to cover their asses, and they'll admit it under the right circumstances. They don't want to change idiotic policies like this because it means they'd have to admit they've been dogmatically enforcing counter-productive policies for decades.
- kevincox 1y agoHardly anyone can tell, until everyone can tell, because you have a breach. It's similar to the idea that if you aren't doing restore drills you aren't really taking backups. But people rarely test their auth rules.
- jeremyjh 1y agoYou could do everything correctly and still have a breach, so practitioners are quite fatalistic about it. The key is to diffuse decision making responsibility so that its not clear who can be fired.
- kiitos 1y agoNo modern IT organization mandates periodical password changes since, I dunno, mid-2000's. edit: please note the "modern" qualifier, tons of IT orgs continue to mandate this anachronistic policy, sure, but those orgs aren't modern, the policy isn't a requirement for e.g. SOC2 or whatever, it's purely historical inertia.
- MBCook 1y agoHa ha ha ha ha. Where do you live? That’s absolutely not my experience.
- staplers 1y agoIs this rage bait?
- nijave 1y agoYes
- joshstrange 1y agoNope, not even close. IT depts continue this practice to this day. I had a friend in ~2015 that said they all had barcode scanners plugged into their computers (not 100% what they used them officially for) and so people would print their password as a barcode and stick it under their desk so they just had to scan the barcode to login (most/some/all? USB barcode scanners present as a keyboard and simply send scans as keypresses) due to silly password rotation rules. He said the people that didn’t use the barcode trick would instead just have a post-it note on their computer or, at best, under the keyboard or in a drawer.