191–200 of 316 posts
Earlier quoted context omitted.
I access my manager from my phone and type them in. I would never install my LastPass on a public computer even if they let me.
Pardon my ignorance but if you're worried about the computer being compromised so that they could somehow access your LastPass, why would you even use it for any authenticated work in the first place?
I used to have to deal with an enterprise system that required quarterly password changes. The interesting thing about this system was it would refuse to let you set a new password that wasn't sufficiently different from the previous several passwords... Which almost certainly means they were implementing this security measure by storing the passwords in plaintext on the server.
You could take the first N characters of the password and store that as a secure hash. That would catch people choosing password1, password2, etc (but wouldn't help much with 1password, 2password...)
Earlier quoted context omitted.
Bruce Schneier's summarization [0] of NIST's revised recommendations: 1. Stop it with the annoying password complexity rules. They make passwords harder to remember. They increase errors because artificially complex passwords are harder to type in. And they don't help that much. It's better to allow people to use pass phrases. 2. Stop it with password expiration. That was an old idea for an old way we used computers.…
Unfortunately my company claims their credit card and electronic payment processing agreements require employee password to expire. If that’s actually true, then most companies hands are tied until those payment agencies update their requirements.
There is no incentive for change. Look what happened with Equifax.
Earlier quoted context omitted.
Bruce Schneier's summarization [0] of NIST's revised recommendations: 1. Stop it with the annoying password complexity rules. They make passwords harder to remember. They increase errors because artificially complex passwords are harder to type in. And they don't help that much. It's better to allow people to use pass phrases. 2. Stop it with password expiration. That was an old idea for an old way we used computers.…
I agree with all of this except password managers. If you use a lot of different public computers or temporary work laptops they don’t always let you install LastPass, so I frequently ended up being unable to access my accounts.
Earlier quoted context omitted.
You should never, ever, ever type a password on a public computer.
So basically, you should never use public computers for anything beyond looking at YouTube anonymously?
The kinds of things that people get put on watchlist for, like where to buy industrial quantities of hydrofluoric acid.
Because time is money, and the employees' time was all chargeable at about $250/hour, the IT guy was tasked with the job of changing everyone's password himself right before the 90 days were up. He just kept everyone's passwords in a password manager, and the "Notes" field contained the password change pattern the user wanted to follow.
Being the IT guy's manager I was able to exclude myself from these crazy shenanigans, but no one else was so lucky. In fact, many people asked for their passwords to be synced by the IT guy for other services they use at work!
Earlier quoted context omitted.
Unfortunately my company claims their credit card and electronic payment processing agreements require employee password to expire. If that’s actually true, then most companies hands are tied until those payment agencies update their requirements.
This is true, PCI DSS still requires password expiry. The trick is figuring out the boundary of the systems that are subject to PCI.
We’ve been using a compensating control of “our password policy is exactly NIST SP 800-63B (2017) plus two more characters in Min length” for our PCI audits since the revision was published in 2017.
It’s been accepted three times so far.
Earlier quoted context omitted.
Are you saying NIST and Schneier are wrong about this?
Schneier says "don't make people change their passwords unless there's indication of compromise" I make the assumption that the longer a password exists, the more likely it's reused and compromised. I don't have insight into every password dump, but I know my users reuse passwords a lot. I think a long expiry is the best balance in my environment.