Ironically only the passwords I’m forced to change frequently (i.e. my work password) are something simple and easy to type. All of my personal passwords are like 40 characters of gibberish my password manager invented and the password to that is similar to the xkcd batteryhorsestaple and is changed from time to time as well.
But my work doesn’t allow password managers, so I just have a rolling window of like 12 passwords since that’s their history limit.
Yes, password expiry is generally considered bad practice and should only be triggered on demand if there’s suspicion of a security breach, precisely because it’s much more likely to lead to simple, less secure passwords. And when users change it, they will probably just add a number or something anyway, so it’s not going to stop a determined attacker from finding the new pw regardless.
Which doesn’t stop a ton of organizations from requiring it anyway.
Ironically only the passwords I’m forced to change frequently (i.e. my work password) are something simple and easy to type. All of my personal passwords are like 40 characters of gibberish my password manager invented and the password to that is similar to the xkcd batteryhorsestaple and is changed from time to time as well.
But my work doesn’t allow password managers, so I just have a rolling window of like 12 passwords since that’s their history limit.
Yup. Most corporate and government security is downright hilarious.
Yes, password expiry is generally considered bad practice and should only be triggered on demand if there’s suspicion of a security breach, precisely because it’s much more likely to lead to simple, less secure passwords. And when users change it, they will probably just add a number or something anyway, so it’s not going to stop a determined attacker from finding the new pw regardless.
Which doesn’t stop a ton of organizations from requiring it anyway.