I worked at a place (fortune 500) that would only let your password be exactly 8 characters, no symbols, so it was compatible with a mainframe system, this password was reused across other systems for simplicity. It's a better policy than nothing, but it's not much better. So if you get an old password, you essentially have the current and future passwords. In practice though, pretty much all people use a variation of their standard password and iterate a number at the end. It also prevents people from using their "standard" password that they use on every other site. If your password gets leaked, it doesn't matter cause it's different in 30 days. Rotating passwords is a good example of a good intention with poor implemention. On top of human limitations resulting in things like iterating passwords, passwords using guessable words, two people using similar passwords by chance, and reusing the same password across lots of websites. Rotation requirements, length (in the wrong sense), multiple systems relying on master passwords. Most places I've worked have pretty asinine password policies for non-admin users. Since security is a major component of your job, I'm assuming you're educated on the subject and the rest of my post isn't meant for you. If you're a Network Admin for a critical agency of the federal government or a fortune 500 company, obviously your passwords are significantly more valuable. If you're a H&H engineer for a state government, a well set up IT system would limit the amount of damage a compromised password of yours would cause anyway. If you already have good password habits they don't do a lot, but they're great for breaking bad habits.įirst let's get one thing clear that's always an issue on this sub, it really depends on what type of engineer you are. They aren't anymore insane to use than any other password system, they pretty much all have flaws. I use them, not Google Chrome's or Safari's, but a dedicated one I pay for (LastPass, also heard good things about 1password).
0 kommentar(er)
