Taking over historically grown IT is hell
My work has a mandatory password update every ~3 months, seemingly keeps all previous hashes, and some employees have been around for 20+ years.
I feel for the IT security team.
Mandatory password updates go against NIST standards
Clearly our company has set their own standards…
…this is also on top of 2FA, Zscaler, and a few other secure network requirements I haven’t fully poked around. 🤷🏻♂️
We regularly work with a tonne of sensitive and PII data, such that even one leak would be disastrous.
If you’re not using a password manager in 2026 wtf are you doing
The key is to allow a password manager but require a unique password to view each entry
Lol
… Remembering every password?
Jk I probably should, but I’m slightly conspiratorially minded on account of being proven right by Facebook and apple and Spotify and google and…
Use an offline one you can store it on an encrypted usb
On my list after I properly figure out how to play Minecraft beta version fully independent from Microsoft
hmm. that many letters. ok. 1…2…3… ah 16. cool.
here we go:
Input new Password:
Sixteenpassword!
ERROR: you must include a number
there is a number in it you stupid machine.
*ERROR: Your password must have a minimum sixteen characters
Minimum_16_characters
*Your password has been accepted
Just use a damn password manager already
It’s their user password to get into their computers. Password manager won’t help there.
Keep them on their toes. After hunting down the last of them it’s time to introduce multi-factor.
That’s the plan. Can’t wait for their faces…
I’d happily use a passphrase with multiple unrelated 8-12 character words but for some reason most businesses have upper limits on how many characters can be used…
And more and more businesses are also limiting what characters you use, as well.
Like, my random generator uses characters from the entire European UTF-8 printable character set. This expands the number of usable characters from about 68-74 (the typical uppercase, lowercase, 0-9 & special characters) to about 1,200 characters. This includes all Latin, Cyrillic, and Greek variations used across Europe.
Just using the wider UTF-8 range nearly always doubles the bitwise complexity (as KeePass measures it) for passwords of the same length, if not more, thereby dramatically reducing the ability for the password to be brute-forced. Not to mention using characters that are not expected to be in passwords in the first place - most brute forcing simply doesn’t account for that where a primarily English-speaking victim set is concerned.
Plus, the passwords are not short. I usually prefer 32 characters, and in important/mission-critical services I expand it to 64 characters.
Some sites require special characters in their passwords, other websites don’t even allow them. I use a password manager, but still have to tweak the password generation rule for some sites.
That is the character limit on the database field where they store your password in plain text.
Sure, but it’s going on a sticky note taped on the bottom of my keyboard
Look at you with the heavy security. No need for that, right on the monitor should be fine. In fact to avoid confusion you should write ‘Computer PW: correcthorsebatterystaple’ so you don’t forget what the note is there for.
And don’t allow spaces, for some unknown reason.
all this fuckin white space in your password keeps breaking my bespoke homegrown hashing algorithm you pleb
Rule #1 “don’t implement your own security/crypto code unless you are a security expert, and even then…”
Correct Horse Battery Staple
I was setting up a service on my home server, and the default admin password was this, lol.
Also: reference for those who might be confused.
