Hacker News Reader

Try quoting from the government standard, NIST Special Publication 800-63b, section 5.1.1.2, which states: “Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically).”

> What do you recommend?

Increment a digit at the end of your password and stick the current digit on a post-it below your monitor, like everyone does. Then get on with real work.

My company is the same way. I've even quoted NiST recommendations, but they say that ISO standards require it. Ugh

I recommend not working for a company that thinks its own employees are trying to subvert security. What level of trust is that?

The level of trust justified by pretty much all of security research; the insider risk is by far the biggest security risk for most organizations, whether you are talking about physical loss or infosec.

This is why things like MarchPassword2022! comes about ... not that I've ever used that password...