Hacker News Reader

August2016 September2016 October2016 etc.

pls don't hack me

I didn't say it was a good system ;)

As the implementer, I've argued many times about it, but the ITSec bods always think they know best.

Do they put a maximum on how many times you can change your password? If not, you could just cycle through 13 passwords in 5 minutes, then switch back to your original password.

I wrote a PowerShell script that does exactly this for Windows Domains.

http://pastebin.com/raw/ytwy0nCB

In AD there is a MinPasswordAge policy that is typically set to 1 day to thwart exactly this type of work-around.

That's what hexadecimal digits are for :)

Why is why password rolling is then based on an alphabetical roll, or pure numerical increment, or month and year. No real entropy gain!