Conversation

Notices

1. Zorin =^o.o^= (zorinlynx@tiggi.es)'s status on Monday, 15-May-2023 22:31:34 JST Zorin =^o.o^=

   I really hate password/PIN code expiration. It WORSENS security, because you're forced to remember a new password/PIN and after forgetting it a few times will probably write it down. Or you might be tempted to use an easier to remember and less secure password.

   NIST no longer recommends expiring credentials regularly. PLEASE STOP DOING THIS.

   • Wrongthink likes this.
   • Tek say vote (tek@freeradical.zone)'s status on Monday, 15-May-2023 22:35:13 JST Tek say vote

     in reply to

     @zorinlynx This prompted a mini-rant at https://freeradical.zone/@tek/110362252319236404 😀

     Wrongthink likes this.
   • Tek say vote (tek@freeradical.zone)'s status on Monday, 15-May-2023 22:35:14 JST Tek say vote

     in reply to

     @zorinlynx NIST flat-out says *not* to now.

     This has come in handy when various parties wanted us to enforce that policy at work. “We can’t, as that goes against best practices and official recommendations.”

   • Zorin =^o.o^= (zorinlynx@tiggi.es)'s status on Monday, 15-May-2023 22:35:14 JST Zorin =^o.o^=

     in reply to

     • Tek say vote

     @tek I wonder what their motivation was. I can't think of a single person who isn't annoyed by forced credential changing.