Zorin =^o.o^=May 12, 2023

I really hate password/PIN code expiration. It WORSENS security, because you're forced to remember a new password/PIN and after forgetting it a few times will probably write it down. Or you might be tempted to use an easier to remember and less secure password.

NIST no longer recommends expiring credentials regularly. PLEASE STOP DOING THIS.

Show threadRocksToReplicators

@zorinlynx It's also been the advice of NCSC for many years

https://www.ncsc.gov.uk/collection/passwords/updating-your-approach#:~:text=The%20NCSC%20is%20working%20to%20reduce%20organisations%27%20reliance,your%20wider%20access%20control%20and%20identity%20management%20approach.

Password policy: updating your approach

Advice for system owners responsible for determining password policies and identity management within their organisations.

May 12, 2023 at 7:34pmWeb