Loading…
15
Am I the only one who thinks changing passwords every 90 days is a waste of my time?
My IT guy at a small office in Tulsa set our systems to force a new password every 90 days, and for two years I did it without thinking. Then I read the actual NIST guidance from 2017 that says forced rotation makes people pick weaker passwords and just add a 1 at the end, which is exactly what I was doing. We switched to one long passphrase plus 2FA about 8 months ago, and I have not forgotten a login since. The old rule felt like security but it mostly just trained me to be lazy. Has anyone else pushed back on their boss about this, or am I the odd one out here?
0 comments
Log in to join the discussion
Log In0 Comments
No comments yet
Be the first to share your thoughts on this discussion.