• Gormadt@lemmy.blahaj.zone
        link
        fedilink
        arrow-up
        2
        ·
        1 year ago

        I won’t say where I work but we have strict password requirements including that they have to be exactly 8 characters long.

        Yeah our passwords aren’t very secure as we also have to change them every 90 days and if you miss the window by 3 days you have to call the IT desk to reset it which takes about 45 minutes to an hour. And in that time you basically can’t get anything done.

        At home I use a password manager and all my passwords are randomly generated and whenever possible 2fa is enabled.

        • abraxas@lemmy.ml
          link
          fedilink
          English
          arrow-up
          2
          ·
          1 year ago

          Not sure if you’re in the US. But if you are, you should leave this anonymously on the security team’s desks.

          > Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator. - NIST control SP 800-63B Section 5.1.1.2

          Basically a fairly widespread standard of security. All kinda of complaince you can fall out of if you do business with anyone who cares about NIST controls.

        • Trapping5341@lemmy.world
          link
          fedilink
          arrow-up
          1
          ·
          1 year ago

          Personally I would use a password manager for at work as well. Bitwarden can generate 8 character passwords. Easy enough to remember and if you forget it’s right there on your phone.

        • TheMauveAvenger@lemmy.world
          link
          fedilink
          arrow-up
          0
          arrow-down
          1
          ·
          1 year ago

          Get as many people as you can to change their password on or around the same day. 93 days later either bombard IT with simultaneous requests or maybe stagger them to eat up their resources for days.

      • abraxas@lemmy.ml
        link
        fedilink
        English
        arrow-up
        0
        arrow-down
        1
        ·
        1 year ago

        I do. This still happens to me regularly. Companies love to fuck with their password algorithms way too much.