1,176 karma · joined June 27, 2011
One day someone that had legitimate access to the password list was fired/quit and the VP decided we needed to have everyone (~800 users, 700 remote) call the helpdesk to reset their password. All the helpdesk calls waiting for a password reset clogged the voice T1 (23 lines) for the office, preventing most calls in or out. Oops.
Thankfully when the company came in-scope for sarbanes-oxley the external consultant we hired to help with the audit said there was no way we could continue logging user passwords and stay compliant.
[1] https://news.sky.com/story/covid-19-rejected-contracts-and-a...
Actually, you could argue they're around the same age. ARPANET switched from NCP to TCP on 1 January 1983 [1] and the initial SS7 standard was released by the ITU in 1988.
On the bank side, I've seen the Level 2/3 information exposed to users of a purchasing cards (read: company credit cards). On the monthly statements we'd see line-item details for some vendors, like Best Buy. Travel purchases included flight segment details, cabin class, etc.
[1] https://www08.wellsfargomedia.com/assets/pdf/small-business/...
You can, but typically you'd use a badge with a PIN. If you use something like this[1] with virtual desktops (VDI) that don't terminate your session when you disconnect, you can get the "time to login" down to a few seconds, since it's the same RDP session following the user around.
[1] https://www.identityautomation.com/iam-platform/healthcare-c...