At some point most security recommendations are self-defeating.

I work in the IT section of a bank and they force a change every 30 days and can only have an 8 character password no more no less 🙃

Ideally we'd all use password managers, but I'm aware 99% of peoole don't. Even with one, it's frankly a pain in the butt to be nagged about changing it. "Man, my passwords are 20 random characters. I don't need yo reset ot unless you've had a breach."

A job I quit about 6mos ago required monthly changes. It was awful. And, yes, it absolutely led to me just incrementing a number at the end. I knew it was time to quit when I was about to hit double digit numbers.

Some IT guys have caught on to this and require 2 digits difference.

So "ThisJobSucks#11" becomes "ThisJobSucks#22"

{Sitename}+{SaLt}+{yymmdd of password change} easy peasy

Hey, how do you know my password?

And despite security recommendations, too many IT depts still force password resets every 90 days...

It could be for contractual or for insurance reasons. We have some contracts with government agencies that require it, and our cyberinsurance also does. Even though NIST has been recommending for years to do long passphrase + MFA and no reset unless you suspect compromise.

So yeah, the reason behind this might not be just plain incompetence.

The worst is when you have a bunch of independent systems that all have their own login info, all configured by the dame IT department, all with different forced reset timers.

I've had arguments with clients' IT security about this in the past where they demanded forced password resets. Citing NIST controls that insist you should avoid them was apparently insufficient.

The most infuriating part is when this happens while using a password from a password manager

What if I were to tell you my password manager password is the most vulnerable of all?

Nobody would guess it's hunter2.

I promise you that does not help.

I suspect a large number of these incidents are due to the password field in the login page allowing fewer characters than the field in the sign up page, so the password gets truncated. A couple of help desk meat shields have confirmed that for me, but mostly I think this because it seems to fix itself if I use a shorter password.

How short, you ask? Who tf knows! They sure as shit won't tell you! Just spend the next 20 minutes trying shit til it works, because you have nothing better to do with your time!

My parents. All written down on paper in handy notebooks for anyone that breaks in. Two entire lives and everything in them just there for the taking.

If it helps, I think we’re all in this picture at some point lol.

So do I. This still happens.

I'm guessing this is american target and not Australian target