21–30 of 59 posts
At a client's who requires frequent password changes, people simply write out their passwords on post it notes that they stick onto their screens. Some security. (That's a bank, by the way).
Obviously sticking it on your screen is a terrible idea, but if it's in a drawer (especially a locker one), it's probably not going to get stolen, especially not in a bank.
I've seen people handle such requirements by creating an initial password, say p@$$w0rd and then appending a digit to it. On any subsequent mandatory password change event, they increment the new password from p@$$w0rd0 to p@$$w0rd1.
Not sure if it leads to anything more secure.
Wish more people started to use GPG based password store such as pass [0].
For those who work at corporations with password rotation policies, it may actually be a good way to get creative. This guy changed password rotations into a lifehack: https://medium.com/the-lighthouse/how-a-password-changed-my-... Previous discussion on it: https://news.ycombinator.com/item?id=8015470
I hope that the passwords thus created emerge from good thoughts and not otherwise.
I would guess that phishing works better than password guessing. Not arguing for weak passwords, just thinking big picture.
Unless you have the same password across a dozen sites.
I suspect that the requirement of (1) changing the password every n days, (2) new password cannot be the same as previous m passwords (usually, m=10) leads to insecure passwords for most. I've seen people handle such requirements by creating an initial password, say p@$$w0rd and then appending a digit to it. On any subsequent mandatory password change event, they increment the new password from p@$$w0rd0 to p@$$w0rd1…
Does anyone aside from HN type folks listen to these recommendations? I just had a major banking institution send me a plaintext pw instead of reset token, with a 15 char limit, and a rotation requirement.
Where I work, we change passwords every 90 days, but every password other than full disk encryption, login and password manager are auto generated by password manager, so this mechanic is less of a concern.
At a client's who requires frequent password changes, people simply write out their passwords on post it notes that they stick onto their screens. Some security. (That's a bank, by the way).
I suspect that the requirement of (1) changing the password every n days, (2) new password cannot be the same as previous m passwords (usually, m=10) leads to insecure passwords for most. I've seen people handle such requirements by creating an initial password, say p@$$w0rd and then appending a digit to it. On any subsequent mandatory password change event, they increment the new password from p@$$w0rd0 to p@$$w0rd1…
Mentioned in the article.