271–280 of 539 posts
Earlier quoted context omitted.
if my password has not been leaked it's insane that providers think i should rotate it, but this still seems to be standard practice for some completely baffling reason
There’s weird math that says your password or generally a secret key is more secure if it’s existed for less time (generated fresh) because there hasn’t been as much time to brute force it. I don’t believe it but some hardcore types do.
you have to believe it, it's true, you just think it's not the greatest threat or that the response to mitigate it (for example, using a pattern of temporary passwords to facilitate remembering them) would be worse than the disease.
Earlier quoted context omitted.
This requirement is in section 8.3.9 of the PCI DSS[0], and only applies to single-factor authentication implementations, two-factor auth removes this requirement. [0] https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard...
Your broker/bank still needs to do it, unfortunately... someone please fix this :( [0] https://www.finra.org/filing-reporting/entitlement/password-...
> If the password length is 16 to 32 characters, it will be valid for 365 days
Madness.
Earlier quoted context omitted.
Had that on the WiFi system at a facility I used to work from for a while. When you connect to their WiFi, you go to a guest portal to connect to the internet. The guest portal grants your MAC address 24 hours of access. Meaning one day you get to work at 9, the next day you get in at 8:55, you’ll have 5 minutes more of WiFi before things just stop working and your system takes a minute to realize you need to reauth…
This is why 24 hours is a particularly bad timespan for reauthentication. With e.g. 16 hours, you’d at least get a predictable prompt on each new workday.
Earlier quoted context omitted.
This requirement is in section 8.3.9 of the PCI DSS[0], and only applies to single-factor authentication implementations, two-factor auth removes this requirement. [0] https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard...
Your broker/bank still needs to do it, unfortunately... someone please fix this :( [0] https://www.finra.org/filing-reporting/entitlement/password-...
My employer just started doing daily reauth for all microsoft logins (teams, ...). The worst thing is that it's just 24h not start of day, so it may just be five seconds before you want to join a meeting. They haven't found the setting for mobile yet, so I might just stop using desktop teams.
Earlier quoted context omitted.
Don't tell them. I don't want to have to enter 30 characters. And it does not help for the people you'd need it for anyway. 1234567890a1234567890@1234567890 Better? No, just longer to type. You can't fix stupid people by making the life of non-stupid people worse. All you do is for non-stupid people to stop caring and do the easiest thing possible too.
That's why we recommend passphrases. That 30 character requirement becomes much easier when it's 3-4 words with a separater. Faster to type, too.
Earlier quoted context omitted.
Don't tell them. I don't want to have to enter 30 characters. And it does not help for the people you'd need it for anyway. 1234567890a1234567890@1234567890 Better? No, just longer to type. You can't fix stupid people by making the life of non-stupid people worse. All you do is for non-stupid people to stop caring and do the easiest thing possible too.
Correct-horse-battery-staple!! is 30 characters and quick to type
Earlier quoted context omitted.
There’s weird math that says your password or generally a secret key is more secure if it’s existed for less time (generated fresh) because there hasn’t been as much time to brute force it. I don’t believe it but some hardcore types do.
> I don’t believe it but you have to believe it, it's true, you just think it's not the greatest threat or that the response to mitigate it (for example, using a pattern of temporary passwords to facilitate remembering them) would be worse than the disease.
It’s especially annoying when a company enforces these brain dead policies on employees. You want people to waste mental effort changing their passwords by 1 letter every 3 months, just to appease some IT manager? Give me a break lol.
I’d rather have a long complex password that i remember and remember ONCE.
Earlier quoted context omitted.
And it's even worse if you are accessing Apple services on a non-Apple device. No matter how many times I click "trust device" when logging in to icloud.com it will still make me do the password + one-time code song and dance the next day. Another pointless annoyance - if Face ID fails when making a payment or installing an app (like it frequently does for reasons like sleeping in bed or wearing sunglasses) it won't…
Microsoft crap is similarly broken. After each and every login there is the question whether it should remember me and whether it should ask that question again. It doesn't matter at all what you answewr there, it changes absolutely nothing.