i had to login for some functions at work. i believe the minimums were 8 characters, 1 caapitol, 1 number. and we all hated it, because the passwords had to be changed every 90 days, and you couldn’t reuse passwords. eventually you are going to run out of things you can reasonably use that you could remember and then would be forced to use some sort of password manager. but OOPSIE you couldn’t install any software on the office computer so you would have to resort to writing them down somewhere. it was a mess.
fortunately corporate decided to just change the entire system adopting most of these rules, min 15 characters, no special character, no hints, no forced changing passwords unless you think you have been compromised or just want to change it. we do have to use 2fa to access some things if you aren’t sitting at the office computer but other than that people are much happier about passwords now.
For places that require periodic password changes I always append 2024Q3 or similar on the end of the same password. I KNOW that’s not secure, but f that place for being dumb
I would always just create 1 password and append a number and it’s special char, cycling from 1 to 0; like 1!, 2@, 3#. Never stayed at a place long enough to go higher than 7 or 8.
I never gave a fuck about doing this because it’s the companies fault for applying stupid policies. Whenever I’ve been allowed a password manager, they got real security instead of malicious compliance.
i had to login for some functions at work. i believe the minimums were 8 characters, 1 caapitol, 1 number. and we all hated it, because the passwords had to be changed every 90 days, and you couldn’t reuse passwords. eventually you are going to run out of things you can reasonably use that you could remember and then would be forced to use some sort of password manager. but OOPSIE you couldn’t install any software on the office computer so you would have to resort to writing them down somewhere. it was a mess.
fortunately corporate decided to just change the entire system adopting most of these rules, min 15 characters, no special character, no hints, no forced changing passwords unless you think you have been compromised or just want to change it. we do have to use 2fa to access some things if you aren’t sitting at the office computer but other than that people are much happier about passwords now.
Stockholm1 (capitol)
90 days later:
Stockholm2
Half the users passwords is going to be {Company}@{YEAR}
Don’t forget classics like Fuck_this_shit1! Fuck_this_shit2!
Oh umm. I would never make my password this…
For places that require periodic password changes I always append 2024Q3 or similar on the end of the same password. I KNOW that’s not secure, but f that place for being dumb
I would always just create 1 password and append a number and it’s special char, cycling from 1 to 0; like
1!,2@,3#. Never stayed at a place long enough to go higher than 7 or 8.I never gave a fuck about doing this because it’s the companies fault for applying stupid policies. Whenever I’ve been allowed a password manager, they got real security instead of malicious compliance.
I feel like it’s not a big impact on security if I use 2fa anyway. (Base password)(month)(year) is fine for me 😅
Ah, the downstream effects of compliance teams.
“Hurry we gotta check off all the boxes!!! What do these measures actually address? Don’t know, don’t care! Comply!”