Egregoros

Sigh.

Just got told by a company internal app that it's time to change my password.

Can we please stop with the fake #security? My password is a long string of randomly generated characters. Nobody's going to guess it any time soon.

#cybersecurity #infosec

@argv_minus_one I still believe in password rotation on long intervals (1 year min). Passwords that get spread across multiple systems (e.g. LDAP, OIDC) get used and abused and shoved into god knows what by people and it contains the damage to some extent of a lost first factor which happens all the time.

@7666 @argv_minus_one 1 year is reasonable and I would go even lower to 6 months at max. That said, there are companies that force password changes every 2 months and sometimes even faster. At that point it misses the point completely, because much more employees will just stick some number at the end or capitalize one letter and be done with it.

Guessing isn't the issue. If the hash gets exposed in a breach, attackers can brute-force it at their leisure. Rotation helps ensure that by the time they crack it, it's no longer valid. Rotation policy should thererore be based on projected brute-force time per string length, not arbitrary human calendar dates. Set a short password? Well then you're changing it often, don't like it, remember a longer password 🤷‍♀️

@nicholas

Yes, and if they brute-force it at their leisure, they gain…access to the same system they've already breached.

You didn't think I was reusing passwords, did you? I'm not completely incompetent.

Actually, they don't even gain that, because I've been notified that there's been a breach and have already changed my password.

So exactly which threat is being mitigated by time-based password rotation?

@7666 @phnt

@argv_minus_one @nicholas @7666
>You didn't think I was reusing passwords, did you? I'm not completely incompetent.
You aren't 70+% of people in <insert your workplace>.

>So exactly which threat is being mitigated by time-based password rotation?
Forgotten accounts, password reuse.

@phnt

Why are people at your workplace reusing passwords and forgetting accounts?

@nicholas @7666

@argv_minus_one @phnt @nicholas @7666 if my workplace wouldn't enforce password rotation, I could pick a secure password without having to worry about by the time I memorized it, it already expired

so I just make variations on a simple password…