Memes

At some point most security recommendations are self-defeating.

@278 and going strong, across 7 companies. One time, just to mix things up, I used an exclamation mark instead. It was exhilerating. /s

Hey, how do you know my password?

I work in the IT section of a bank and they force a change every 30 days and can only have an 8 character password no more no less 🙃

A job I quit about 6mos ago required monthly changes. It was awful. And, yes, it absolutely led to me just incrementing a number at the end. I knew it was time to quit when I was about to hit double digit numbers.

Ideally we'd all use password managers, but I'm aware 99% of peoole don't. Even with one, it's frankly a pain in the butt to be nagged about changing it. "Man, my passwords are 20 random characters. I don't need yo reset ot unless you've had a breach."

Some IT guys have caught on to this and require 2 digits difference.

So "ThisJobSucks#11" becomes "ThisJobSucks#22"

{Sitename}+{SaLt}+{yymmdd of password change} easy peasy

And despite security recommendations, too many IT depts still force password resets every 90 days...

It could be for contractual or for insurance reasons. We have some contracts with government agencies that require it, and our cyberinsurance also does. Even though NIST has been recommending for years to do long passphrase + MFA and no reset unless you suspect compromise.

So yeah, the reason behind this might not be just plain incompetence.

The most infuriating part is when this happens while using a password from a password manager

What if I were to tell you my password manager password is the most vulnerable of all?

Nobody would guess it's hunter2.

My parents. All written down on paper in handy notebooks for anyone that breaks in. Two entire lives and everything in them just there for the taking.

I promise you that does not help.

I suspect a large number of these incidents are due to the password field in the login page allowing fewer characters than the field in the sign up page, so the password gets truncated. A couple of help desk meat shields have confirmed that for me, but mostly I think this because it seems to fix itself if I use a shorter password.

How short, you ask? Who tf knows! They sure as shit won't tell you! Just spend the next 20 minutes trying shit til it works, because you have nothing better to do with your time!

I do use a password manager but this shit still happens. Does anyone know why? Something to do with a "password hash", I think...

If it helps, I think we’re all in this picture at some point lol.

Or use a fucking password manager like Bitwarden or Keepass

I'm guessing this is american target and not Australian target

So do I. This still happens.