Re: [Link Posting] Password expiration is dead, long live your passwords

From	Rich <rich@example.invalid>
Newsgroups	comp.misc
Subject	Re: [Link Posting] Password expiration is dead, long live your passwords
Date	2019-06-09 14:39 +0000
Organization	A noiseless patient Spider
Message-ID	<qdj5nv$5d2$2@dont-email.me> (permalink)
References	<MlpB1YKRhgDPsuv1m3oW7DKj@dont-email.me> <qd3vu5$ugf$1@dont-email.me> <qdj0dn$2a2$1@solani.org> <87k1duzyf0.fsf@LkoBDZeT.terraraq.uk>

Show all headers | View raw

Richard Kettlewell <invalid@invalid.invalid> wrote:
> RS Wood <rsw@therandymon.com> writes:
>> Here's the money quote:
>>
>> If you have a password at such an organization, I recommend you
>>  send that blog post to its system administrators. They will
>>  ignore you at first, of course, because that?s what enterprise
>>  administrators do, and because information security (like
>>  transportation security) is too often an irrational one-way
>>  ratchet because our culture of fear incentivizes security theater
>>  rather than actual security ? but they may grudgingly begin to
>>  accept that the world has moved on.
> 
> Enterprise system administrators do not make that decision, they merely
> implement it (and deal with the fallout).

Correct.  Enterprise sys. admins are mostly "box checkers".

They are given a long checklist of requirements they must meet.  And 
they simply turn on whatever is necessary to be able to "check the box" 
for their quartery reports upwards in the management chain.

They do not even, usually, have the faintest idea of what is or is not 
secure, nor why.  They just make sure their systems "check off the 
boxes".

So to make any change, the blog post has to be mailed to whomever is 
creating the checklist the admins are expected to follow.  And then 
that person's irrational fears have to finally be quelled enough that 
they remove the "must change password every 60 days" requirement.

Thread

[Link Posting] Password expiration is dead, long live your passwords Rich <rich@example.invalid> - 2019-06-02 21:55 +0000
  Re: [Link Posting] Password expiration is dead, long live your passwords Jerry Peters <jerry@example.invalid> - 2019-06-03 20:28 +0000
    Re: [Link Posting] Password expiration is dead, long live your passwords Rich <rich@example.invalid> - 2019-06-03 20:35 +0000
    Re: [Link Posting] Password expiration is dead, long live your passwords RS Wood <rsw@therandymon.com> - 2019-06-09 09:10 -0400
      Re: [Link Posting] Password expiration is dead, long live your passwords Richard Kettlewell <invalid@invalid.invalid> - 2019-06-09 14:22 +0100
        Re: [Link Posting] Password expiration is dead, long live your passwords Rich <rich@example.invalid> - 2019-06-09 14:39 +0000
      Re: [Link Posting] Password expiration is dead, long live your passwords Jerry Peters <jerry@example.invalid> - 2019-06-09 20:33 +0000
        Re: [Link Posting] Password expiration is dead, long live your passwords ant@zimage.comANT (Ant) - 2019-06-10 11:22 -0500
        Re: [Link Posting] Password expiration is dead, long live your passwords Kerry Imming <kcimming@pobox.com> - 2019-06-10 11:42 -0500
          Re: [Link Posting] Password expiration is dead, long live your passwords Rich <rich@example.invalid> - 2019-06-10 18:05 +0000
          Re: [Link Posting] Password expiration is dead, long live your passwords Richard Kettlewell <invalid@invalid.invalid> - 2019-06-10 22:28 +0100
  Re: [Link Posting] Password expiration is dead, long live your passwords Sylvia Else <sylvia@email.invalid> - 2019-06-11 16:42 +1000
    Re: [Link Posting] Password expiration is dead, long live your passwords Huge <Huge@nowhere.much.invalid> - 2019-06-11 09:39 +0000
      Re: [Link Posting] Password expiration is dead, long live your passwords Sylvia Else <sylvia@email.invalid> - 2019-06-11 20:29 +1000
        Re: [Link Posting] Password expiration is dead, long live your passwords Huge <Huge@nowhere.much.invalid> - 2019-06-11 11:01 +0000
          Re: [Link Posting] Password expiration is dead, long live your  passwords Mike Spencer <mds@bogus.nodomain.nowhere> - 2019-06-11 17:18 -0300
            Re: [Link Posting] Password expiration is dead, long live your  passwords Jerry Peters <jerry@example.invalid> - 2019-06-12 00:04 +0000
              Re: [Link Posting] Password expiration is dead, long live your  passwords Mike Spencer <mds@bogus.nodomain.nowhere> - 2019-06-12 01:49 -0300
              Re: [Link Posting] Password expiration is dead, long live your  passwords Huge <Huge@nowhere.much.invalid> - 2019-06-12 08:49 +0000
            Re: [Link Posting] Password expiration is dead, long live your  passwords Huge <Huge@nowhere.much.invalid> - 2019-06-12 08:57 +0000
      Re: [Link Posting] Password expiration is dead, long live your passwords Jim Jackson <jj@franjam.org.uk> - 2019-06-11 17:57 +0000
        Re: [Link Posting] Password expiration is dead, long live your passwords Rich <rich@example.invalid> - 2019-06-11 18:05 +0000
        Re: [Link Posting] Password expiration is dead, long live your passwords Huge <Huge@nowhere.much.invalid> - 2019-06-11 21:08 +0000
      Re: [Link Posting] Password expiration is dead, long live your passwords Jerry Peters <jerry@example.invalid> - 2019-06-12 00:10 +0000
        Re: [Link Posting] Password expiration is dead, long live your passwords Huge <Huge@nowhere.much.invalid> - 2019-06-12 08:50 +0000
    Re: [Link Posting] Password expiration is dead, long live your passwords Rich <rich@example.invalid> - 2019-06-11 11:03 +0000
      Re: [Link Posting] Password expiration is dead, long live your passwords Sylvia Else <sylvia@email.invalid> - 2019-06-11 21:55 +1000
        Re: [Link Posting] Password expiration is dead, long live your passwords Huge <Huge@nowhere.much.invalid> - 2019-06-11 15:30 +0000
          Re: [Link Posting] Password expiration is dead, long live your  passwords Mike Spencer <mds@bogus.nodomain.nowhere> - 2019-06-11 17:43 -0300
            Re: [Link Posting] Password expiration is dead, long live your  passwords Huge <Huge@nowhere.much.invalid> - 2019-06-12 08:58 +0000
          Re: [Link Posting] Password expiration is dead, long live your passwords kludge@panix.com (Scott Dorsey) - 2019-06-11 21:14 -0400
            Re: [Link Posting] Password expiration is dead, long live your passwords Huge <Huge@nowhere.much.invalid> - 2019-06-12 08:52 +0000
            Re: [Link Posting] Password expiration is dead, long live your passwords Sylvia Else <sylvia@email.invalid> - 2019-06-15 11:45 +1000
              Re: [Link Posting] Password expiration is dead, long live your passwords kludge@panix.com (Scott Dorsey) - 2019-06-15 15:46 -0400
    Re: [Link Posting] Password expiration is dead, long live your passwords Kerry Imming <kcimming@pobox.com> - 2019-06-11 12:19 -0500
      Re: [Link Posting] Password expiration is dead, long live your passwords Huge <Huge@nowhere.much.invalid> - 2019-06-11 18:21 +0000
    Re: [Link Posting] Password expiration is dead, long live your passwords kludge@panix.com (Scott Dorsey) - 2019-06-11 21:12 -0400

csiph-web