This practice is not recommended anymore, yet still found in many enterprises.
You must log in or register to comment.
It’s even better when the company saves your old passwords, just so you can’t use them again.
Just add a number suffix and increment it each time. This doesn’t exactly make your password any stronger but that’s not what they’re asking for with their stupid policy.
My company tracks the first and last character so you can’t do that. Personally I change a single character in the middle of my password to work around this.
Error: Your password’s Levenshtein distance indicates that your new password is more than 20% similar to a password previously used within the last 10 years.
Policy requires your password to:
- Be unique
- Have at least one uppercase letter
- Have at least one lowercase letter
- Contain 2 symbols other than apostrophe
- Have 4 numbers that are either separated by other characters, or represent an integer both greater than 3000 and not ending with the same last two digits as the previous or next 17 years from the current date.
- Include exactly one Cryllic character
- Exceed no more than 18 characters
/satire (I hope)
Same. Its so stupid. Doesn’t increase security and just annoys everyone.
My company changed the policy to increase the time between password changes. To compensate, they increased the required password length.
Neither of these policy changes were communicated to the employees. The expiry time tells you when it arrives (don’t tell me you change it before it expires, good for you if you do), but if your new password doesn’t meet the policy requirements it doesn’t tell you what they are. The support request response indicated the minimum length was three letters longer. The only good thing about this ordeal is that I get paid by the hour.
Yeah, but I’m more used to them saying “occasional overtime” when they mean “5-10 hours mandatory overtime, unless it’s actually busy, because we refuse to hire enough people to fill all the open positions.” Because there’s nothing smarter than giving all your sales staff enormous bonuses while the grunts on the floor are over 6 months behind for lack of adequate staffing.
TOTP and KeePassXC is a blessing
I wish every system ever supported TOTP
My company’s HR system (like, time off, time clock, etc.) asks for a new password every 3 months, but it doesn’t give any fucks at all if you just reuse the current password apparently. I’ve been “changing” it to the same thing for like a year now.
Which is often a lot more secure than requiring you to create a new password. Requiring a new password frequently leads to people making memorable passwords which are a lot less secure than a good password which is kept for years.
A few years back, my company suffered a big cyber attack where the attack vector was the credentials of a high level user who frequently changed their password to the year and month for next password change, i.e. “2018october”. Apparently this was common enough that the attackers were able to brute force/guess it.
I prefer that.
I’ve changed my password 11 times since I worked at this job.
How do I know that? Because my solution has been password+1.
Isnt this just bad practice?
Microsoft recommends against it since 2019. But apparently, it is still a thing.
Yes. It’s such a bad practice the fucking White House released an official memo telling people to stop doing it as part of executive order M22-09 (federal zero trust strategy). It applies as a rule to all government and military entities and therefore has been carved out in exceptions for FedRAMP and other compliance frameworks. Stop forcing people to change their fucking passwords.
https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf
Ye this
Glad we are Passwordless. Now none knows me password.
oh i didn’t know that, are companiesy finally realizing that creating and trying to remember new passwords causes more trouble then keeping one really good password?
Only on accounts that have MFA is password rotation no longer recommended.
If the account is non MFA protected password changes are still recommend.
really? what’s the standard for that? like how often should you be rotating your password?
I assumed many people forget their new passwords (because I often do) than are protected by continually rotating passwords.
It’s one of the updated NIST recommendations, I don’t recall which one but it specifically calls out no password cycling for MFA protected accounts.
I have over 500 passwords in my password manager. I don’t know what I’d do without it.
Monthly password change.
Enforced high complexity.
Sticky note on screen.Hey now, it’s under the keyboard. Much more secure there.
ProjectnameMonthYear!!
Monthly? That is insane. Let me guess, no mfa.
Correct!
Are you me
Man, so often do I get half way through my password to realise I’m now typing my old words.
I’m convinced this isn’t particularly secure because it just results in the following. Mandatory password change, password can’t be any of your last six, bla bla bla. Boom rotating stock of my last six, you happy?
“BOB-CEMU” “BOB-MERC” “BOB-SIVA” “BOB-MILK” “BOB-CERA” “BOB-DELT”
Had one company where you couldn’t use the same password for 12 months, 10 digit minimum, and had to change it every month
My very secure password series at the time.
DumbP@ss#01
DumbP@ss#02
DumbP@ss#03
Hey! You lied! None of those worked just now. Tell us your real password.
I’ve got this email today but I have some days left, I think
This 90 days password change BS, is the worst security risk there is. Do you know how many people have Summer2024 as their work computer password because of this system? too damn many! Not to mention the problem it creates for older folks who have a hard time with the change and most times end up locking them selves out. It creates far more chaos than anything secure, which I have been explaining to my company and they still enforce it for their clients.
I am 100% adapting this scheme for my work password! Thank you!
It’s often due to the security department following outdated standards. Nowadays NIST recommends the following:
Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets. Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.
Source: https://pages.nist.gov/800-63-3/sp800-63b.html
That said, the company I work for violates all of the above rules …
Summer2024 is their password? Jeez. What a idiot.
Mine is a proper set of lowercase and uppercase characters, numbers, and symbols, written in a post-it note and taped to my laptop.
Ah I just keep mine in my desk drawer next to the 2FA code fob
Every three months, man. Gets old real fast.
Every month is 3x worse.
Never is too long. Monthly is way to short. I like the idea of doing it yearly in conjunction with other it security awareness and training campaigns.
Never is too long.
Why? Frequent password changes have been shown to result in weaker passwords. What’s wrong with keeping a strong one indefinitely? I mean an actual strong one not one character more than what’s current bruteforceable.
Overtime people will slip up and leak their passwords. Maybe they accidentally log in with it in the username field (causing it to get logged), leave it on a forgotten postit note, share it with a spouse, used it for a 3rd party service, wore a pattern into their keyboard, etc. None of those are that big of a deal or all that common, but added up with enough time and people and the risk accumulates. A infrequent but regular password reset helps to mitigate that risk.
Regular password resets can also help to prevent password reuse. Suppose someone uses their work password for netflix, then work requires a password change. How likely are they to manually sync the netflix password back to match the one they use for work?
Of course there are much better ways to mitigate risk. E.g. multifactor authentication. But a major security principal is defense in depth, and I think reasonably infrequent (e.g. no more than once per year) password resets have a place in that.
This goes for physical keys as well. If it is your house and you are certain no one untrustworthy has your key, then fine. But for a larger org with multiple people and turnover. Sooner or later keys will get lost, misplaced, etc. Rekeying the locks (maybe every 5 years, maybe every 25 years) has merit.
Forever is vulnerable to phishing attacks, same reason why monthly is getting discouraged. Monthly is weaker because the average person does slight variation, which attackers LOVE.
Frequent password changes don’t protect against phishing.
And while a high frequency like monthly changes will probably result in even weaker passwords, also yearly changes will make people choose weak passwords.
Agreed. My last job, we were forced to change all service account passwords annually but our personal passwords every month or two.
My current job has more domains and systems so I have so many more passwords with varying complexity and age requirements. I just set a calendar event for every four weeks (one expires just under 5 weeks) and change them all to the same generated password that meets all the common requirements and I save it in my password manager.
So every four weeks, it’s seriously this hour+ long ritual for virtually no enhanced security reason.
Have you considered scripting it? For a while I worked at a place that required changing passwords every 60 days and it couldn’t have been one of your previous 24 passwords. When checking out the policy I noticed there was no minimum password age so a quick for loop later and Bob becomes your mother’s brother. Quickly cycling through 24 random passwords and back to my secure one and no more just adding the month/year.
Of course I reported it to cyber and about a year later they added a minimum age, now I’m hoping to get them to address an issue in AD that sidesteps changing passwords (though that one may be around for a while).
Unfortunately I don’t think that’s possible for my situation. Most of my passwords require logging into a portal and accepting terms of agreements.
Yeah, future me wonders why I even suggested it, I’m sure it probably violates the spirit of password change requirements.
I mean it’s a clever solution for those without password manages. Plus most of the suggestions in these comments violate the spirit of password change requirements.
