Alt text:
Why couldn't the amulet have been hidden by Aunt Alice, who understands modern key exchange algorithms?
this post was submitted on 19 Dec 2023
1009 points (99.1% liked)
xkcd
8791 readers
127 users here now
A community for a webcomic of romance, sarcasm, math, and language.
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Ironically only the passwords I'm forced to change frequently (i.e. my work password) are something simple and easy to type. All of my personal passwords are like 40 characters of gibberish my password manager invented and the password to that is similar to the xkcd batteryhorsestaple and is changed from time to time as well.
But my work doesn't allow password managers, so I just have a rolling window of like 12 passwords since that's their history limit.
Yup. Most corporate and government security is downright hilarious.
Yes, password expiry is generally considered bad practice and should only be triggered on demand if there's suspicion of a security breach, precisely because it's much more likely to lead to simple, less secure passwords. And when users change it, they will probably just add a number or something anyway, so it's not going to stop a determined attacker from finding the new pw regardless.
Which doesn't stop a ton of organizations from requiring it anyway.