Every 90 days, all day long;

e-sig with old password out of habit.

Get error message.

Say bad word.

Resign with new password.

Repeat in about 15 minutes.

I'm currently at the point where I catch it after I type in the old password and before I hit enter. By the end of the shift I should be good.

AotherNewFuckingP-Word123

Change "123" as/when required.

U.S. govt - every 60 days and different for every system you are in. Can not be written down and they really want you to use one of their password generators which is a nightmare to remember.
Retired now and don't miss the insanity.

6 systems, all with different reset dates, unable to use "common" words such as planet names, car models etc, or the system boots you out.

20+ years ago, my former employer had some bullshit password setting that wasn't based on # of days but instead it was based on # of logins. We had a ton of reboots because we were at the end of a power grid, they were too cheap for UPSs, and of course there was the typical 90s Windows stability issues.

As you can imagine we were all pretty frustrated at changing our passwords several times per month. My boss was back-up system administrator and one day needed to change a CAD setting and asked for my password (can't remember why he couldn't use his admin password). I was pretty embarrassed that my password was profanity laden, but fortunately none of it aimed at any individuals.

Used to work IT in a nuke plant in the early 90s. They had monthly password changes.

I swear I could sit down at any persons desk and login with a password like "August1993", then 30 days later use "September1993"

Please enter your new password:

"cabbage"

Sorry, the password must be more than 8 characters.

"boiled cabbage"

Sorry, the password must contain 1 numerical character.

"1 boiled cabbage"

Sorry, the password cannot have blank spaces.

"50bloodyboiledcabbages"

Sorry, the password must contain at least one upper case character.

"50BLOODYboiledcabbages"

Sorry, the password cannot use more than one upper case character consecutively.

"50BloodyBoiledCabbagesShovedUpYourArse,IfYouDon'tGiveMeAccessnow”

Sorry, the password cannot contain punctuation.

“ReallyPissedOff50BloodyBoiledCabbagesShovedUpYourArseIfYouDontGiveMeAccessnow”

Sorry, that password is already in use!

LMAO!

quote:

Originally posted by sigmonkey:
Please enter your new password:

"cabbage"

Sorry, the password must be more than 8 characters.

"boiled cabbage"

Sorry, the password must contain 1 numerical character.

"1 boiled cabbage"

Sorry, the password cannot have blank spaces.

"50bloodyboiledcabbages"

Sorry, the password must contain at least one upper case character.

"50BLOODYboiledcabbages"

Sorry, the password cannot use more than one upper case character consecutively.

"50BloodyBoiledCabbagesShovedUpYourArse,IfYouDon'tGiveMeAccessnow”

Sorry, the password cannot contain punctuation.

“ReallyPissedOff50BloodyBoiledCabbagesShovedUpYourArseIfYouDontGiveMeAccessnow”

Sorry, that password is already in use!

This is very familiar.

I started using bull****1 and changed the digit every month as necessary. Seemed very fitting.

I had multiple passwords, one for every site I had to access. And one of them had an additional security code that had to be accessed for key code information.

Massive PITA. Most fun I had was after returning from being off on medical for almost three weeks.I came back to a crashed computer due to a coworker and most all of my passwords requiring change. And due to my dominant arm in a sling I had to first wait for IT to come in, blame me (as usual company policy to flip out on the user of the terminal), take four or five hours to decide that the PC was infected and then get another one, set up all the accesses needed then my fun started setting up passwords,shortcuts,favorites,etc. while listening to the boss complain.

Make life easier on yourself. If the expired password is "xyzzy" ... then the new password is Caps Lock "xyzzy". That way the core password lasts two periods.

quote:

Originally posted by LS1 GTO:
AotherNewFuckingP-Word123

Change "123" as/when required.

That's what I do.

Here's what I do:

I let my password expire (oops!). I call our Help Desk, who reset to a default password, which is different for every employee.

I then just use that default password as my password...until oops, it expires again.

It has worked for me for seven years already.

quote:

U.S. govt - every 60 days and different for every system you are in. Can not be written down and they really want you to use one of their password generators which is a nightmare to remember.
Retired now and don't miss the insanity.

I submit that only a small minority of people with extraordinary memory skills can remember all the usernames and passwords in a common work environment. And when you have to completely change them frequently, no way normal people can do this. Yes, I know you aren't supposed to write them down but us mere mortals must do so and management is just fooling themselves to believe otherwise.

Wayback when, when they suggested mandatory password changes, it made sense. Now, it does not, and it's actually not recommended anymore, which makes coming up with another password even more aggravating, since it'll be another decade before they switch back to not requiring it.

https://www.ftc.gov/news-event...ory-password-changes

I set the password policy in my organization as follows.

- 14 characters.

- Mixed case, one or more letters, and one or more non alpha-numeric characters.

I ask folks to pick a couple non related words and use numbers and symbols to replace some of the alpha characters.

For example, "plastic planets" is 15 length.

Make it "plasticplanets", now 14 length.

Then change it to this: "pl@st1cplan3ts" and it is easy to recall, meets strong complexity and I do not ask them to change it, unless it is compromised.

I also have everything set to prevent "brute force" by limiting/locking attempts to several seconds/minutes/hours/days/weeks/months intervals for times when someone may "mistype" a password.

Normal screw ups will still allow one to "get in" if they "fat finger" their password, but attempts that are run "too fast" or "too frequent" will be automatically locked out, flagged and I am notified.

If it is a legitimate failure on a user, they can contact me and I can provide them access.

This also serves to highlight a hack attempt on a user or a brute force against the enterprise.

This policy helps ensure people use strong effective and easy to recall passwords, prevents them from writing them down and no need to change them unless it is warranted.

I started doing this over 20 years ago and never suffered a breach due to passwords.

Having spent the last 36 years working in IT, and having grown tired of the sheer number of passwords that I have to remember and 2FA authenticators that I have to carry, this is one of the reasons that I've transitioned most of my stuff at the house to using Yubikey authentication, and I have been lobbying for the doing the same at the office.

Don't use dictionary words.
Use at least 1 upper case letter.
Use at least 1 special character.
Use at least 1 lower case letter.
Use at least 12 characters.
Don't use the same password across different systems.
Change passwords every 30-90 days.
Don't write passwords down.
Don't reuse passwords.

All of this sounds really smart and reasonable, until you realize that you now have to track over a 100 different ever changing nonsensical passwords.