• MrQuallzin@lemmy.world
    56·
    2 years ago

    One of our systems at work don’t let you use the past thirteen passwords! Plus monthly password changes. Guess who’s got a generic password that has an ever increasing number at the end of it…

    • ipkpjersi@lemmy.ml
      18·
      2 years ago

      Pretty much everyone, which is why NIST no longer recommends automatic password expiry anymore.

    • Nelots@lemm.eeEnglish
      9·
      2 years ago

      This is what password managers are nice for. I only know like two of my passwords all across the internet.

        • lugal@sopuli.xyz
          1·
          2 years ago

          Lunar calendars also have 12 months but each is shorter and so the year is shorter. Some have a leap month but that doesn’t help either. Sure, you can iterate thru these names but that doesn’t help you to remember to current one. The idea of using months is that you know in which month you are right now.

  • andyburke@kbin.social
    49·
    2 years ago

    FWIW: these types of password rules are discouraged by NIST -

    1. Eliminate Periodic Resets

    Many companies ask their users to reset their passwords every few months, thinking that any unauthorized person who obtained a user’s password will soon be locked out. However, frequent password changes can actually make security worse.

    It’s difficult enough to remember one good password a year. And since users often have numerous passwords to remember already, they often resort to changing their passwords in predictable patterns, such as adding a single character to the end of their last password or replacing a letter with a symbol that looks like it (such as $ instead of S).

    So if an attacker already knows a user’s previous password, it won’t be difficult to crack the new one. The NIST guidelines state that periodic password-change requirements should be removed for this reason.

    • CluelessLemmyng@lemmy.sdf.org
      12·
      2 years ago

      They also recommend implementing 2FA, but not OTP or TOTP as they are now considered not secure enough. Use 2FA that is FIDO2 compliant such as biometrics or fobs like Yubikey.

      • Polar@lemmy.ca
        3·
        2 years ago

        How is a TOTP not secure? It’s a random string that changes every 30 seconds. I mean shit, I am LOOKING at it, and sometimes fail a login because I run out of time.

  • arefx@lemmy.ml
    14·
    2 years ago

    Spotify won’t let you use a password you’ve used in the past at all so now I don’t even know what my password for it has evolved into and I just reset my password and type something random in every time I need to log in lmao

  • FARTYSHARTBLAST@kbin.social
    13·
    2 years ago

    Might be you got your password scrambled after a compromised account: It denies attackers the opportunity to use your compromised password.

  • Mothra@mander.xyz
    6·
    2 years ago

    Why does this happen though? I always wondered why is it that a platform recognises your old password only when you are trying to change it

    • tillary@sh.itjust.works
      4·
      2 years ago

      If there were a data breach where a hacker could figure out the encryption algorithm, you don’t want users to reuse an older password because those older passwords could’ve already been cracked.

      By the way, this is why you should also never use the same password for every site. If one of your passwords is leaked and linked to a similar username or email, everything is vulnerable. I’ve had this happen before (the Target breach). After that I started using SSO exclusively, with a random 16 char password manager if SSO isn’t an option (crossing my fingers that bitwarden doesn’t get hacked like LastPass)

      • Mothra@mander.xyz
        3·
        2 years ago

        I understand when you are prompted to change, but not when you aren’t. As I mentioned in another comment I remember Epic basically trolling me into resetting my password almost daily at some point

        • tillary@sh.itjust.works
          2·
          2 years ago

          There could be many reasons they don’t prompt you to change: they meant to send an email but your notification preferences disallowed it, they sent an email and you missed it, they wanted to keep it quiet, they forgot to add the message and ux flow to change password, or they’re incompetent and didn’t know they needed to do that.

          The Epic thing I’ve never seen before but that’s definitely incompetence and/or a very weird bug that just slipped past them.

    • BirdyBoogleBop@lemmy.dbzer0.com
      1·
      2 years ago

      Because it runs the hash again on the new password against the old one, if it matches the old one you are told to change it as you used the old password again.

      • Mothra@mander.xyz
        3·
        2 years ago

        Yes yes but I don’t mean when I’m told to change one. I mean when I’m trying to login as usual, password doesn’t work, so I change it. Just to test of the password I was using was wrong, that’s what I use first- and it’s rejected.

        I remember Epic would do this on a DAILY basis at some point last year. It was so irritating. “Ah yes the brand new password from yesterday that worked yesterday but that we didn’t recognise on the login page today? Well we do recognise here on the reset, jokes on you!”

  • majestictechie@lemmy.fosshost.comEnglish
    42·
    2 years ago

    I always find these types of posts frustrating. Apart from your desktop password, a password manager solves a lot of these issues. Just make the password manager super secure, use 2fa and then auto generate all other passwords.