3 ms·
Perfect example of why habituating users to renewing credentials (typically password expiration) is a terrible practice.
by twoodfin 1y ago
Perfect example of why habituating users to renewing credentials (typically password expiration) is a terrible practice.
- anonymars 1y agoFrustrating that you're being downvoted https://pages.nist.gov/800-63-FAQ/#q-b05 https://pages.nist.gov/800-63-FAQ/#q-b05
- NooneAtAll3 1y agois there an actual habituation? that message feels like it could work as a first-time as well
- twoodfin 1y agoWe should be immediately suspicious when we get any solicitation to "renew" something "expired" in a security domain. Swapping un-compromised secrets is essentially always more risky than leaving them be. Regardless of whether the real NPM had done this in the past, decades of dumb password expiration policies have trained us that requests like this are to be expected rather than suspected.
- nicoburns 1y agoIf legitimate companies didn't do this, then the email would be suspicious.
- deleted 1y ago[deleted]