slazer2au comments on Your password has expired

Your password has expired (thelemmy.club)

submitted 2 years ago* by cron@feddit.org to c/cybersecuritymemes@lemmy.world

This practice is not recommended anymore, yet still found in many enterprises.

[–] slazer2au@lemmy.world 6 points 2 years ago (3 children)

Only on accounts that have MFA is password rotation no longer recommended.

If the account is non MFA protected password changes are still recommend.

parent

[–] Varyk@sh.itjust.works 5 points 2 years ago* (last edited 2 years ago) (2 children)

really? what's the standard for that? like how often should you be rotating your password?

I assumed many people forget their new passwords (because I often do) and become compromised than are protected by continually rotating passwords.

parent

[–] skittlebrau@lemmy.world 6 points 2 years ago

I have over 500 passwords in my password manager. I don’t know what I’d do without it.

parent

[–] slazer2au@lemmy.world 2 points 2 years ago

It's one of the updated NIST recommendations, I don't recall which one but it specifically calls out no password cycling for MFA protected accounts.

parent