re: “Password does not meet minimum requirements”

quote:

---

this is an absolutely terrible practice.

---

Made more likely by high standards, and requiring users to change passwords frequently.

quote:

---

Length is far more important than complexity

---

TWSS

Mine is almost always some variation of FkUMtherFker1!

quote:

---

It’ll take 15 years to change for NERC CIP

---

I think you're being waaaay too optimistic for those jokers

quote:

---

I have to keep a written log of all of my passwords with shorthand for what websites or applications they are used for.

---

All of my passwords are on post-it notes taped to the inside of a cabinet door in my office. If we actually had an internal IT guy, I'm sure he would hate me

quote:

---

At my work, they now require the password to be at least 15 characters long. 

---

Little known fact, this is actually the real reason Gaucho became a welder.

quote:

---

Because there are still too many regulatory requirements that dictate this, and when your security department is run by box-checking auditors, that's the result.

NIST has only just recently dropped frequent password changes and instead advocates long pass phrases and using MFA.

That's going to take time to trickle down through the box checking compliance groups that control security in large corporate environments.

---

This. Having worked a good chunk of IT in the banking industry, it's required. Why? Because of dipshits that do shite like this:



I don't want to lose my job because the company lost its arse in a data breach because of some careless a-hole. People don't realize that information security starts with you, not the IT department.

To be honest, I would like to see biometrics become more prevalent. While it too has it's flaws, it's far better than someone leaving their passwords out in plain sight.

What I found interesting is that if you type :password: and then put your TD password in colons like you're doing an emoji, it censors it for you when you post, like so:

:password:********:

quote:

---

you frickers are the ones opening the spoofed emails too

---

To be fair, that shite is getting very hard to detect.

We've had multiple cases where our clients were compromised through Office365 phish, bad guy controlled the emails, searched the emails, found our client was due to receive an electronic deposit from one of our attorneys for a real estate transaction, contacted the attorney via email impersonating the client (with perfect English and grammar that matched the client's way of typing/writing) directing the direct deposit to a new account number. Our attorney questioned the change, and the bad guy responded...again with a very, very believable email. Thankfully our attorney was smart and made a phone call to confirm.

Office365 phishing is rampant right now because very few people use MFA and implicitly trust a Microsoft login page, even when spoofed.

PassWord#123456 Upper Case, Lower Case, length 15 characters with a special character.