Ours isn’t like that at all. They dont even have to change it every three months. The insecurity is crazy here and they still can’t remember the same password they’ve had since before I started working here.
Forcing password changes too frequently is actually a security risk, as it encourages bad practices like re-use, iteration, keyboard walks and writing the passwords down.
There are reasonable limits to impose on this, and educating users with demonstrations such as haveibeenpwned have been highly effective in my experience.
Ours isn’t like that at all. They dont even have to change it every three months. The insecurity is crazy here and they still can’t remember the same password they’ve had since before I started working here.
Forcing password changes too frequently is actually a security risk, as it encourages bad practices like re-use, iteration, keyboard walks and writing the passwords down.
There are reasonable limits to impose on this, and educating users with demonstrations such as haveibeenpwned have been highly effective in my experience.