Microsoft’s research team studied this extensively. They looked at what actually happens when you enforce complexity requirements. Users don’t create randomly generated passwords. They follow predictable patterns. Capital letter at the start. Numbers at the end. Exclamation point at the very end. The word “Password” appears in about eight percent of “complex” passwords. When you force rotation, users increment numbers. Summer2024 becomes Fall2024. Or they add exclamation points. Or they change a single character and call it done. The false sense of security is dangerous. IT departments see compliance numbers go up. Everyone is following the password policy. The auditors are happy. Meanwhile, actual security hasn’t improved at all.
I’ve done a lot of internal infrastructure pentests, for companies of various sizes, and there wasn’t a single pentest where spraying MonthYYYY for the past two months wouldn’t get at least one hit.
That, and the fact that every company has at least one server hidden somwhere that’s still vulnerable to MS17-010, that they can’t update or replace for one reason or the other.
It makes me smile a little to know that the spirit of ms08-067 still lives on in some way.
More people need a mooltipass and Keepassxc
They’ll never figure out my secret technique… TWO exclamation points!!
Every competent InfoSec dept knows that NIST recommenda a strong password you never rotate unless compromised and yet every corporate policy I’ve ever witnessed forces password rotation constantly.
Security is 100% theatre.
No shit, Sherlock ©. I know nothing about cyber security and even I read somewhere years ago exactly the same: forcing password rotation with complexity rules does not make anything more secure
Yea it does one thing.
It hides exactly when there was a breach somewhere that forced a password reset.
Which is good when you know there will be a breach and mass password reset and want to cover your ass. Thank you, now it makes sense
new policy: your password must not have been used by any other user in our system. That’s it.
“Sorry, you can’t have that password. Someone else’'s already using it” is an amazingly useful piece of information to give someone, even an existing employee.
All this is correct. But I’ll also add the following:
Most people probably DGAF if their password for work is compromised. They have no skin in the game for whatever their data entry or email is for BigCorp, they’re treated like “monkey push button, monkey get banana,” forced to jump through password hoops and they’re sick of doing it every few weeks or months. So they use the simplest they can get away with and the easiest to remember so they don’t have to call some corpo IT help desk that will roll their eyes at yet another password reset.
Oh noes! Not my work microsoft account! Hack anything but that!
Now tell us about passkey.
