5 ms·
No modern IT organization mandates periodical password changes since, I dunno, mid-2000's. edit: please note the "modern" qualifier, tons of IT orgs continue t
by kiitos 1y ago
No modern IT organization mandates periodical password changes since, I dunno, mid-2000's.
edit: please note the "modern" qualifier, tons of IT orgs continue to mandate this anachronistic policy, sure, but those orgs aren't modern, the policy isn't a requirement for e.g. SOC2 or whatever, it's purely historical inertia.
- MBCook 1y agoHa ha ha ha ha. Where do you live? That’s absolutely not my experience.
- staplers 1y agoIs this rage bait?
- nijave 1y agoYes
- joshstrange 1y agoNope, not even close. IT depts continue this practice to this day. I had a friend in ~2015 that said they all had barcode scanners plugged into their computers (not 100% what they used them officially for) and so people would print their password as a barcode and stick it under their desk so they just had to scan the barcode to login (most/some/all? USB barcode scanners present as a keyboard and simply send scans as keypresses) due to silly password rotation rules. He said the people that didn’t use the barcode trick would instead just have a post-it note on their computer or, at best, under the keyboard or in a drawer.
- kiitos 1y agoYes, many anachronistic and out-of-date IT depts continue this practice, indeed.
- paxys 1y agoNo true scotsman mandates password changes
- MBCook 1y agoGenius. I love it. I was reading about keyboard firmware last night and saw the ability to do “tap dances”, where a series of specific key presses in short order can trigger a predefined action. It instantly occurred to me how useful it would be to be able to quickly type “QWE” and have one long complex password input for you automatically. Then “ZXC” for another, etc. Of course flashing your passwords directly into your keyboard firmware is probably a pretty big security no-no. But all the places that love to enforce constant password changes with super specific rules sure make something like that sound appealing.
- paradox460 1y agoYou don't even need to go full keyboard. You can flash qmk or similar firmware to a single key device. You now have something like a yubikey, that only ever outputs one password
- ExoticPearTree 1y agoWe deployed the barcode scanner with passwords too. It works wonders. People that use the system are super happy they don't have to type in "secure passwords" and some security auditors are happy we have the "enable password complexity" checkbox ticked.
- inglor_cz 1y agoMy Microsoft account is definitely bothersome like this. I never searched for the root cause (tenant policies? some default value somewhere?), but I have to refresh my password every 4 months or so.
- qualeed 1y agoIt's a setting in the admin.microsoft.com portal (Org settings -> Security & privacy -> Password expiration policy). The setting, funny enough, is literally "Set passwords to never expire (recommended)". They also link to "Learn why passwords that never expire are more secure" in the same place. Anyone who is forcing expiry is specifically going against recommended policies (Microsoft's, NIST's, and any serious security person) for some reason or other.
- ExoticPearTree 1y agoWe had to prove we have a password expiration policy for a compliance audit, showed them that MS recommends not to have passwords expire and the NIST guidance and the auditors were supper happy.
- qualeed 1y agoSeveral frameworks are (finally) catching up to modern day understanding, and have either forgone the requirement for password rotation or have various exemptions if other technical measures are in place. But I agree, for those that haven't changed, it's incredibly frustrating to hamstring your own security so that you can pass a compliance or security audit. I obviously don't know which framework you are auditing against, so can't be specific, but it may be worth double-checking the requirements rather than relying on the assessor's word (if you aren't already). It is not unheard of for assessors to be behind on their understanding of best practices (especially those who've been an assessor for a long period of time - they may be going more by habit and previous engagements instead of the most up-to-date documents).
- kiitos 1y ago
- icedchai 1y agoI have one that emails me every 3 months to change my password. Very annoying.
- thyristan 1y agoEven worse. NIS2 in the European Union makes password changes legally required for many organisations. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=PI_COM:C(2024)7151 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=PI_... 11.6.2 (c)
- MBCook 1y agoI’ve been told PCI does as well, though I don’t know if that’s really still true. Edit: jjav beat me to it below, confirming it is.
- qualeed 1y agoPCI DSS 4.0 does not require password rotation unless the password is the only authentication (i.e. no MFA). Use MFA, and you don't need to rotate. >Clarified that this requirement applies if passwords/passphrases are used as the only authentication factor for user access (i.e., in any single-factor authentication implementation). >Added the option to determine access to resources automatically by dynamically analyzing the security posture of accounts, instead of changing passwords/passphrases at least once every 90 days.
- bux93 1y agoYikes, whoever wrote that should be ashamed of themselves. On the bright side, it doesn't specify how long the predefined interval should be, and says entities are to 'ensure the strength of authentication is appropriate to the classification of the asset to be accessed' - so, in order to ensure the appropriate strenght the interval should be 100 years is totally defensible IMHO. The whole paragraph doesn't take MFA in account anyway, and FIDO2 does provide for key rotation (even if it's not widely implemented, maybe something to consider if you're covered by NIS2 - or manually rotate keys once every year).
- thyristan 1y ago11.3. (a) mandates multi-factor auth for priviledged and sysadmin accounts, and 11.7. requires multi-factor auth depending on criticality determinations. All in addition to whatever is in 11.6. But the thought about the non-specified intervals in 11.6. is great, nowhere in there are any numbers to be found. So basically one can do the sensible thing, set some huge numbers that are no problem in practice and everything is fine.
- jjav 1y ago> the policy isn't a requirement for e.g. SOC2 or whatever It is a PCI requirement and probably from other sources. Of course it is brain dead and we even have authoritative documentation from NIST explaining why it is stupid, but nobody at PCI has any technical skills to understand that so the madness lives on.
- kiitos 1y agoIt is for sure not a PCI requirement that user system passwords need to be changed on any kind of interval. At least, I've been a member of several PCI-compliant organizations that did not have or enforce this policy.
- qualeed 1y ago>It is a PCI requirement The only requirement for password rotation in PCI DSS v4.0 is if the password is the only form of authentication (i.e. no MFA). Use MFA (which you should be anyways) and you don't need to enforce password rotation. >Clarified that this requirement applies if passwords/passphrases are used as the only authentication factor for user access (i.e., in any single-factor authentication implementation). >Added the option to determine access to resources automatically by dynamically analyzing the security posture of accounts, instead of changing passwords/passphrases at least once every 90 days.
- jjav 1y ago> The only requirement for password rotation in PCI DSS v4.0 is if the password is the only form of authentication (i.e. no MFA). Use MFA (which you should be anyways) and you don't need to enforce password rotation. We just completed our PCI audit for the year and the auditor is adamant that this is the requirement. Perhaps they're wrong, but fighting with the auditors is like wrestling with pigs, best avoided.
- paradox460 1y agoNo true Scotsman