• Meldroc@lemmy.world
    6·
    1 year ago

    And despite security recommendations, too many IT depts still force password resets every 90 days…

    And people confronted with this change their password from “p@55w0rd!1” to “p@55w0rd@2”. Yep extra-secure!

    • AlecSadler@lemmy.world
      1·
      1 year ago

      A job I quit about 6mos ago required monthly changes. It was awful. And, yes, it absolutely led to me just incrementing a number at the end. I knew it was time to quit when I was about to hit double digit numbers.

      • Narjah@lemmy.world
        1·
        1 year ago

        I college we had to change our password every semester. Guess who added the semester number onto the end of their password. Hint: everyone.

        Same as a government job that required monthly password changes. Well, at least those people had more security than the post-it note on the monitor people

    • The_v@lemmy.world
      0·
      1 year ago

      Some IT guys have caught on to this and require 2 digits difference.

      So “ThisJobSucks#11” becomes “ThisJobSucks#22”

        • Blackmist@feddit.uk
          1·
          1 year ago

          Well they don’t need to store it to a drive. You just entered your old password in order to login and authorise your password change.

          It’ll still be in memory against your session.

        • Hawk@lemmy.dbzer0.com
          1·
          1 year ago

          Used to have monthly changes for a Microsoft account. When trying to change, it said “You used this password 6 months ago, please use another”, besides the “passwords needs to be at least this different” message. Clearly they are storing them, not sure if they’re stored cleartext or they’re decrypting them on the fly somehow

          • psilocybin@discuss.tchncs.de
            1·
            1 year ago

            You should not be able to decrypt a password, passwords aren’t encrypted but hashed, they would be insecure would they be encrypted.

            Hashing differs from encryption in that it is irreversible, because two or more strings might result in the same hash if the hashing function is applied to them (hashing is not injective).

            But since your password will always yield the same hash you can compare the two hashes and if they are equal you are considered authenticated. If you try to log in with a different password (or even the hash of the correct password) then it will produce a different hash resulting in a failed authentication attempt

            The way crackers get a password if they have the hash is by guessing pw candidates and using the hash function on them, if its the same as the hash they have they found the/a valid password. The guessing can be quite involved and with enough time and data about a victim often 12-13 digit passwords with special characters and all can be cracked - If the victim used a somewhat mnemonic pw that is. Generated pws from a password safe are much safer (but usually also longer).

            In your case I suspect MS was storing a history of hashes which is not advisable as it gives potential crackers more to work with, but its way less bad then storing plain text or encrypting passwords