And despite security recommendations, too many IT depts still force password resets every 90 days…
And people confronted with this change their password from “p@55w0rd!1” to “p@55w0rd@2”. Yep extra-secure!
At some point most security recommendations are self-defeating.
A job I quit about 6mos ago required monthly changes. It was awful. And, yes, it absolutely led to me just incrementing a number at the end. I knew it was time to quit when I was about to hit double digit numbers.
you’re saying not to hold a job for more than 10 months?
It was a joke.
But also, holding a shitty toxic job for 10mos took a mental health toll.
But also, I don’t know, in some cases that might be good advice. Since 2020 I’ve changed jobs every 6-10mos and I’m making triple what I made in 2019, so that’s nice.
Ideally we’d all use password managers, but I’m aware 99% of peoole don’t. Even with one, it’s frankly a pain in the butt to be nagged about changing it. “Man, my passwords are 20 random characters. I don’t need yo reset ot unless you’ve had a breach.”
Password managers are great. Until you need to log in with a new device or a device that’s not yours.
Oh, the sixteen digit randomly generated password with two alphanumeric characters in it? Sure I remember that.
You gotta use word-based passcodes instead of random jibberish. That way you can quickly read it from your phone and type it in.
I work in the IT section of a bank and they force a change every 30 days and can only have an 8 character password no more no less 🙃
Seems like a job for Bobby tables
Hey, how do you know my password?
Some IT guys have caught on to this and require 2 digits difference.
So “ThisJobSucks#11” becomes “ThisJobSucks#22”
How would they know how many digits changed? They don’t store the password in cleartext.
Right?
…
{Sitename}+{SaLt}+{yymmdd of password change} easy peasy
I college we had to change our password every semester. Guess who added the semester number onto the end of their password. Hint: everyone.
Same as a government job that required monthly password changes. Well, at least those people had more security than the post-it note on the monitor people
NavyExchange!(ddmm of password change) for as long as I worked there, it was really only to use a register though, I had nothing compromising behind the password lock.
I’ve had arguments with clients’ IT security about this in the past where they demanded forced password resets. Citing NIST controls that insist you should avoid them was apparently insufficient.
The worst is when you have a bunch of independent systems that all have their own login info, all configured by the dame IT department, all with different forced reset timers.
Who still isn’t using a password manager?
The most infuriating part is when this happens while using a password from a password manager
The fact this happens is infuriating. 😣
Then you finally do the password change, go to login and now the new password doesn’t work because you copied it to clipboard and overwrote it somehow in that small time frame goddamn shit! I always win+r and put it there until I know everything is all good.
Maybe use the clipboard history on Windows? (Win+V)
Coming from a Linux background and being forced to use windows 10/11 at work, this was a game changer for me when i accidentally mis-keyed this shortcut and turned on the history feature. Now I use it literally dozens or hundreds of times each day.
Task failed successfully!
What if I were to tell you my password manager password is the most vulnerable of all?
Nobody would guess it’s hunter2.
I only see ******* when you type hunter2
Thank God!
You should really upgrade to hunter3
But how did you see it? I used the spoiler tag
/s
I promise you that does not help.
I suspect a large number of these incidents are due to the password field in the login page allowing fewer characters than the field in the sign up page, so the password gets truncated. A couple of help desk meat shields have confirmed that for me, but mostly I think this because it seems to fix itself if I use a shorter password.
How short, you ask? Who tf knows! They sure as shit won’t tell you! Just spend the next 20 minutes trying shit til it works, because you have nothing better to do with your time!
My company doesn’t tell you what the AD policy is for changing your domain logon password but windows will just tell you that it doesn’t meet the policy. What IS the password policy you ask?
Well it’s uh… 🤷♂️
Try again!
I am annoyed on your behalf.
I’ve had goons tell me they can’t tell me the character max because of “security”
Ah, of course! Security through obscurity.
Stelth
Yeah I’ve noticed this a few times as well. It’s pretty bad.
Thank you for validating my self-indulgent rant :)
My parents. All written down on paper in handy notebooks for anyone that breaks in. Two entire lives and everything in them just there for the taking.
If I recall, a few (most) security experts now support written-on-paper passwords. Why? Because it is the solution for users who would otherwise commit far a more egregious security faux pas otherwise.
In most circumstances, it is easier to keep the notebook secure than your wallet, your car, etc. And let’s be honest, the list of suspects are REALLY short if someone breaks into your house, opens the third drawer, grabs the notebook and runs. And if it’s more than that and somebody ransacks your entire house, I guarantee having to change your passwords is the least of your headaches.
Ultimately, physical compromise is the lowest possible security risk for most people throughout their lives. Yes, it happens. Yes, it sucks. But having your bank password out in the wild with nobody realizing it is possibly far more dangerous.
I do use a password manager but this shit still happens. Does anyone know why? Something to do with a “password hash”, I think…
They are just gaslighting you. Its a global conspiracy in tech industry
1 week later: EZ Pass has majority of user passwords compromised, giving hackers access to bank records of 8 million Americans.
That’s even more reason to use a password manager. You’re far more likely to have unique passwords per site. If one gets compromised, others don’t.
Idk who is safe to use for password mgmt. I haven’t seen data leaks for my banking institutions who probably have enforced regulations for IT security. Are there standards in place for password manager products? What brands are reputable?
Yourself. I use Vaultwarden on a Raspberry Pi. Lots of people use something like KeePass and sync it with Dropbox or something similar. As far as someone else hosting it, Bitwarden seems like the go to (and is the project that Vaultwarden is based on).
You must be using double-strength ROT13 encryption.
Why am I in this picture?
If it helps, I think we’re all in this picture at some point lol.
C00kies!
6 months later: C00kies?
6 months later: C00kies!
6 months later: C00kies?
This is how it’s done.
Or use a fucking password manager like Bitwarden or Keepass
I use bitwarden on my android phone and home computer. Vivaldi browser on both devices with bw integration. I also was able to portable-load Vivaldi on my work pc, so one day when I’m not too busy, I intend to regen my work passwords (everything but the domain logon is web-based) with bitwarden so I never have to worry about how many ones and exclamation points I appended to my passwords.
Now if I could only get them to replace Microsoft 365 OTPs with a smart card or RSA hardware token that’d be perfect. Especially when Teams and every other Microsoft app separately and individually decides for the nth time this week that they all need my credentials again because somebody sneezed near the work VPN server and caused the ntp to be off by a millisecond and invalidate my security certificate or… whatever the reason that happens.
I do. This still happens to me regularly. Companies love to fuck with their password algorithms way too much.
Ahh, so you all also shop at target online, eh?
I’m guessing this is american target and not Australian target
And that’s why I generate my passwords randomly.
Thank you Bitwarden.
So do I. This still happens.
Whelp…reevaluate life.
We need the bonus frame showing a funeral occurring, let’s make this dark.
Why is that? Couldn’t find anything on Google.
I feel stupid. Can someone explain this to me? Is it saying people have a hard time coming up with a new password?
The joke is that he set the password to the same thing he thought it was to begin with — the same password the site said was incorrect, it’s now saying was in fact his old password.
I forget where, but this has happened to me before. I thiiiink the logic was that it compares to your last 3 passwords, not just the most recent one. So if I had the password “hunter2”, then changed it to “swordfish”, then later forgot that and tried to log in with “hunter2”, this is what would happen.
I’ve also had similar but completely inexplicable experiences with my cell phone provider, who shall remain nameless. My best guess is that my special characters (still ASCII but not alphanumeric) broke their poor lil database. It wouldn’t accept anything until I set a strictly alphanumeric password.
