3 ms·

Forcing password changes -- e.g., "you're locked out until you change your password" -- means that the student must select a new password right now, whatever ti

by jtheory 12y ago

Forcing password changes -- e.g., "you're locked out until you change your password" -- means that the student must select a new password right now, whatever time pressure they're under. Most people in a rush aren't going to do a good job choosing a secure new password; they aren't going to read McGill's recommendations about password managers or whatever; they're not even going to take 30 seconds to think about how to come up with a reasonably secure but memorable password. They're just going to use their old password with a "1" on the end. So -- McGill came up with a way to keep nudging students into updating their passwords, without forcing the specific moment they need to do it.

fnordfnordfnord 12y ago
I'm at a .edu, not McGill. I'll relate my experience with forced password changes. >Most people in a rush aren't going to do a good job choosing a secure new password; Yup. This happens once per year without fail, and more often if there is some security problem. Often enough, it happens during a busy time of the semester (beginning or end). >they aren't going to read McGill's recommendations about password managers or whatever; they're not even going to take 30 seconds to think about how to come up with a reasonably secure but memorable password. My employer's IT department's password advice is... vintage, to be kind. It took a shaming in front of the college president to get them to stop threatening people for writing passwords down. The clunky password rules are at least partly responsible for the typically weak passwords. Another factor is the practice of configuration of machines with timeouts in the 10 to 30 minute range, forcing people to constantly enter their passwords. Yet another is the number of disparate IT systems with different password databases, and different password rules.

by jtheory 12y ago

fnordfnordfnord 12y ago

I'm at a .edu, not McGill. I'll relate my experience with forced password changes. >Most people in a rush aren't going to do a good job choosing a secure new password; Yup. This happens once per year without fail, and more often if there is some security problem. Often enough, it happens during a busy time of the semester (beginning or end). >they aren't going to read McGill's recommendations about password managers or whatever; they're not even going to take 30 seconds to think about how to come up with a reasonably secure but memorable password. My employer's IT department's password advice is... vintage, to be kind. It took a shaming in front of the college president to get them to stop threatening people for writing passwords down. The clunky password rules are at least partly responsible for the typically weak passwords. Another factor is the practice of configuration of machines with timeouts in the 10 to 30 minute range, forcing people to constantly enter their passwords. Yet another is the number of disparate IT systems with different password databases, and different password rules.