546
NIST proposes barring some of the most nonsensical password rules
(arstechnica.com)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 26 Sep 2024
546 points (99.3% liked)
Technology
59982 readers
2425 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 2 years ago
MODERATORS
i had to login for some functions at work. i believe the minimums were 8 characters, 1 caapitol, 1 number. and we all hated it, because the passwords had to be changed every 90 days, and you couldn't reuse passwords. eventually you are going to run out of things you can reasonably use that you could remember and then would be forced to use some sort of password manager. but OOPSIE you couldn't install any software on the office computer so you would have to resort to writing them down somewhere. it was a mess.
fortunately corporate decided to just change the entire system adopting most of these rules, min 15 characters, no special character, no hints, no forced changing passwords unless you think you have been compromised or just want to change it. we do have to use 2fa to access some things if you aren't sitting at the office computer but other than that people are much happier about passwords now.
Half the users passwords is going to be {Company}@{YEAR}
Don't forget classics like Fuck_this_shit1! Fuck_this_shit2!
Oh umm. I would never make my password this...
Deleted
I would always just create 1 password and append a number and it's special char, cycling from 1 to 0; like
1!,2@,3#. Never stayed at a place long enough to go higher than 7 or 8.I never gave a fuck about doing this because it's the companies fault for applying stupid policies. Whenever I've been allowed a password manager, they got real security instead of malicious compliance.
I feel like it's not a big impact on security if I use 2fa anyway. (Base password)(month)(year) is fine for me ๐
Ah, the downstream effects of compliance teams.
"Hurry we gotta check off all the boxes!!! What do these measures actually address? Don't know, don't care! Comply!"
Stockholm1 (capitol)
90 days later:
Stockholm2