Ideally we’d all use password managers, but I’m aware 99% of peoole don’t. Even with one, it’s frankly a pain in the butt to be nagged about changing it. “Man, my passwords are 20 random characters. I don’t need yo reset ot unless you’ve had a breach.”
A job I quit about 6mos ago required monthly changes. It was awful. And, yes, it absolutely led to me just incrementing a number at the end. I knew it was time to quit when I was about to hit double digit numbers.
But also, holding a shitty toxic job for 10mos took a mental health toll.
But also, I don’t know, in some cases that might be good advice. Since 2020 I’ve changed jobs every 6-10mos and I’m making triple what I made in 2019, so that’s nice.
I college we had to change our password every semester. Guess who added the semester number onto the end of their password. Hint: everyone.
Same as a government job that required monthly password changes. Well, at least those people had more security than the post-it note on the monitor people
NavyExchange!(ddmm of password change) for as long as I worked there, it was really only to use a register though, I had nothing compromising behind the password lock.
You’re not supposed to have the old password. If you had the old password you could just compare it to the new password.
The only way you can do it is to take the new password and make a hash for every possible single-character variation and compare them all to the old hash
They shouldn’t be storing the old password hashed, either. Expired password hashes should be destroyed like any other potentially-sensitive information that is no longer business critical.
There is a reason hackers look to get users tables even though the passwords are hashed. Because with enough of them and enough time, they can usually figure out plaintext. Giving them 10 previous hashed passwords for each user is just increasing the hypothetical risk.
Sorry, that’s what I meant as well :) Came out upside down when I wrote. We used to figure out shitty ISP router passwords this way by having a table of common passwords and their hashes.
The worst is when you have a bunch of independent systems that all have their own login info, all configured by the dame IT department, all with different forced reset timers.
I’ve had arguments with clients’ IT security about this in the past where they demanded forced password resets. Citing NIST controls that insist you should avoid them was apparently insufficient.
And despite security recommendations, too many IT depts still force password resets every 90 days…
And people confronted with this change their password from “p@55w0rd!1” to “p@55w0rd@2”. Yep extra-secure!
At some point most security recommendations are self-defeating.
Ideally we’d all use password managers, but I’m aware 99% of peoole don’t. Even with one, it’s frankly a pain in the butt to be nagged about changing it. “Man, my passwords are 20 random characters. I don’t need yo reset ot unless you’ve had a breach.”
Password managers are great. Until you need to log in with a new device or a device that’s not yours.
Oh, the sixteen digit randomly generated password with two alphanumeric characters in it? Sure I remember that.
You gotta use word-based passcodes instead of random jibberish. That way you can quickly read it from your phone and type it in.
A job I quit about 6mos ago required monthly changes. It was awful. And, yes, it absolutely led to me just incrementing a number at the end. I knew it was time to quit when I was about to hit double digit numbers.
you’re saying not to hold a job for more than 10 months?
It was a joke.
But also, holding a shitty toxic job for 10mos took a mental health toll.
But also, I don’t know, in some cases that might be good advice. Since 2020 I’ve changed jobs every 6-10mos and I’m making triple what I made in 2019, so that’s nice.
@278 and going strong, across 7 companies. One time, just to mix things up, I used an exclamation mark instead. It was exhilerating. /s
I work in the IT section of a bank and they force a change every 30 days and can only have an 8 character password no more no less 🙃
{Sitename}+{SaLt}+{yymmdd of password change} easy peasy
I college we had to change our password every semester. Guess who added the semester number onto the end of their password. Hint: everyone.
Same as a government job that required monthly password changes. Well, at least those people had more security than the post-it note on the monitor people
NavyExchange!(ddmm of password change) for as long as I worked there, it was really only to use a register though, I had nothing compromising behind the password lock.
Some IT guys have caught on to this and require 2 digits difference.
So “ThisJobSucks#11” becomes “ThisJobSucks#22”
How would they know how many digits changed? They don’t store the password in cleartext.
Right?
…
You could take the old password, change one or two letters and compare the hash to the hash of the new password?
That’s the point though.
You’re not supposed to have the old password. If you had the old password you could just compare it to the new password.
The only way you can do it is to take the new password and make a hash for every possible single-character variation and compare them all to the old hash
They shouldn’t be storing the old password hashed, either. Expired password hashes should be destroyed like any other potentially-sensitive information that is no longer business critical.
There is a reason hackers look to get users tables even though the passwords are hashed. Because with enough of them and enough time, they can usually figure out plaintext. Giving them 10 previous hashed passwords for each user is just increasing the hypothetical risk.
You’re right ofc if you wanted to make a general remark, but wrong if you thought that was what I was implying. Never store hash histories, kids!
Sorry, that’s what I meant as well :) Came out upside down when I wrote. We used to figure out shitty ISP router passwords this way by having a table of common passwords and their hashes.
The worst is when you have a bunch of independent systems that all have their own login info, all configured by the dame IT department, all with different forced reset timers.
I’ve had arguments with clients’ IT security about this in the past where they demanded forced password resets. Citing NIST controls that insist you should avoid them was apparently insufficient.