Hacker News Reader

Comment by dylan604 | Hacker News Reader

> It's been strictly recommended against in the NIST guidelines (and others) for nearing a decade now.

And yet it is still the recommended practice for every IT department for pretty much all corps. Even AWS has their forced 90 password reset policy where you start to get reminders 15 days early so it's actually 75 days. Only at AWS, they don't force you into the password rotation flow at the end of the 90, they automatically lock the account. While that might make sense for inactive accounts, for accounts that have clicked the Not Now for 14 days should be taken to a change password screen instead. /rant

View on HN

> Even AWS has their forced 90 password reset policy

This is a policy set by the organization. You can easily change it to longer in IAM (or disable it entirely).

Sometimes, "you" are not able to do that and you just work for someone else managing that. I had 90 reset policy with 2FA. annoying AF

Another AWS set of creds is SSO+2FA, and no longer has the rotating policy. It's like a breath of fresh air.

Turns out, just like TFA, several security audits I've been through all list the password rotation policy in them.

>And yet it is still the recommended practice for every IT department for pretty much all corps

Not any that I or my colleagues consult at.

well congratulations to you. do you like to kick people when they're down to make yourself feel superior or was there another point to your comment? Great there's at least 3 companies that do not have this policy. That in no way negates all of the companies that do.

This is a really hostile comment. Sorry that your upset, but you don't need to take it out on me.

>or was there another point to your comment?

The purpose of my comment was to refute your claim that arbitrary password resets is the "recommended practice for every IT department for pretty much all corps".

Because it's not true.

>Great there's at least 3 companies that do not have this policy.

Between me and my colleagues we consult at dozens to hundreds of corporations per year. "At least 3" is pretty disingenuous.

sarcastic. not hostile.

do you honestly believe that i was unaware that there are companies that do not require the rotation policy? maybe the "pretty much all" phrase was confusing and you did not think that left room for some to not?

that's great that there are some companies that do not, but there are a great number of people that still do. it's not anything that needs rebutting as we're all aware they exist

>maybe the "pretty much all" phrase was confusing and you did not think that left room for some to not?

~90% or more of the companies we consult with do not have forced arbitrary password rotations when we start our engagement with them (~100% do not have it by the end of the engagement). We engage with dozens to hundreds of companies a year.

Does your definition of "pretty much all" actually mean "a small portion"? No wonder I was confused...

dozens to hundreds !== large percentage

I'm looking at a sample of well over a thousand companies across multiple years where the vast majority (~90%) do not have a forced rotation and now ~100% of them do not. You can safely extrapolate that out to a general statistic.

Where are you getting your numbers from? What data are you reviewing?

So by your own comment there were thousands of companies that absolutely were still using rotation policies until they were blessed with your consultation.

Sounds like your doing the lord's work. Godspeed

>absolutely were still using rotation policies

That is not what I said. In fact, that's the complete opposite of what I said! Here, I'll add some emphasis for you.

>"~90% or more of the companies we consult with do not have forced arbitrary password rotations ___when we start our engagement with them___"

Reply on news.ycombinator.com