Microsoft’s research team studied this extensively. They looked at what actually happens when you enforce complexity requirements. Users don’t create randomly generated passwords. They follow predictable patterns. Capital letter at the start. Numbers at the end. Exclamation point at the very end. The word “Password” appears in about eight percent of “complex” passwords. When you force rotation, users increment numbers. Summer2024 becomes Fall2024. Or they add exclamation points. Or they change a single character and call it done. The false sense of security is dangerous. IT departments see compliance numbers go up. Everyone is following the password policy. The auditors are happy. Meanwhile, actual security hasn’t improved at all.
You must log in or register to comment.
- VitoRobles@lemmy.todayEnglish15 hours
I was so happy when we finally hired a director of security and the first thing he did was stop forcing us to rotate passwords every month.
It was so fucking insane.
- scytale@piefed.zipEnglish14 hours
It was commonly 90 days for regular user accounts, and 30 days for admin/privileged accounts.
- vrighter@discuss.tchncs.deEnglish4 hours
with automated password rotation, and no api access (no permission to use api access, that is) to the keyvault. And they expected us to automate stuff too!
- RedGreenBlue@lemmy.zipEnglish12 hours
Don’t let the user choose their password. Use passkey and randomly generate a secure password. Encourage passwordless login.
- SreudianFlip@sh.itjust.worksEnglish11 hours
This leads to endless resets as users fail to manage the unmemorizeable passwords, which as you probably know, exposes these kinds of users to new risks via email etc…
17 hoursI’ve done a lot of internal infrastructure pentests, for companies of various sizes, and there wasn’t a single pentest where spraying MonthYYYY for the past two months wouldn’t get at least one hit.
That, and the fact that every company has at least one server hidden somwhere that’s still vulnerable to MS17-010, that they can’t update or replace for one reason or the other.
- Tango@piefed.caEnglish13 hours
I assume if special characters were required then it became MonthYYYY!, yes?
- redsand@infosec.pubEnglish12 hours
I was pretty sure that was eternal blue but didn’t believe it would still be relevant 10 years later.
- Hasherm0n@lemmy.worldEnglish12 hours
It makes me smile a little to know that the spirit of ms08-067 still lives on in some way.
- HubertManne@piefed.socialEnglish14 hours
here is the thing about working at a corp. I ask IT if there is a vetted password manager to use. They say they don’t have one. If I use one now im storing company passwords on unvetted software. thing is the corp has you do all this training and have you sign off you will keep to its guidelines.
- VitoRobles@lemmy.todayEnglish15 hours
Came to the comments and you were downvoted?
Downvoter, what’s the problem with these tools?
- Shanmugha@lemmy.worldEnglish16 hours
No shit, Sherlock ©. I know nothing about cyber security and even I read somewhere years ago exactly the same: forcing password rotation with complexity rules does not make anything more secure
- chuck@lemmy.caEnglish4 hours
Yea it does one thing.
It hides exactly when there was a breach somewhere that forced a password reset.
