Any company that still insists on forced password resets and frequent changes needs to learn about Social Engineering and Human Factors.
These are the same companies that don't support second factors, only have their app as a second factor, or only SMS second factor. Is it too much to ask for smart card or token (yubikey) support?
I hate that stuff. Also websites that have lots of specific conditions for what a password contains. You're just increasing the likelihood of me forgetting it.
I started using a password manager for a lot of my passwords. Works pretty well, it’ll generate criteria matching passwords for me. Also functions as a list of websites I’ve created accounts with.
And if you don't forget it, you'll use a simple one that's easy to guess or contains common substitutions, p@$$w0rd!. And then when you do forget it you'll call support who will reset it, and they get so many calls it will make taking over another account easier.
I don't think I've gotten past finding the correct length video. Getting that to work with everything else and keeping what's his face alive is just too much.
My company set up two factor for office 365. The type of verification used is the outlook app where you tap on something to gain access. I must have been one of the first to be required to change my password on the stupid 90 day schedule. After changing my 365 account pw I was locked out because I had to log in to the Outlook app and use the outlook app for verification, which didn't work due to the need to be logged in. You can't make this shit up.
Well, it's also on Microsoft for selling their "modern" security theater bullshit to every IT department in the country while not designing it in a sensible fashion or working with third parties to provide meaningful alternatives to the Microsoft branded shit every employee will soon be required to install on their personal devices...
But that's also on your IT department for not warning you or allowing you to keep the SMS/phone verification as a backup for these exact situations. Those aren't depreciated yet, but some companies have let Microsoft's recommend security practices (co-written by their sales team) scare them into downright idiocy.
As someone in IT, here's what you do: Next time that sort of thing happens, just reach out to them immediately and have them reset everything. They may get annoyed, but you know what? They shouldn't be. It's more secure to have an employee call in every single time they need to change a password or re-authenticate a device. It's inconvenient, unnecessary, and downright annoying, wasting everyone's valuable time, but hey....it's more "secure'. If it's more secure, you aren't allowed to be against it.
Every few months my company forces a password reset. We recently changed from four digit pins to full true passwords but they don't actually explain that so now you have people with like 13 digit pins it's insane. On top of that they also use two-factor Authentication simply to make things harder I believe.
Finally if you want your work email on your phone it forces you to re login every single week and because of the way Outlook mobile works you need this special number from Outlook on your phone so to log into outlook on my phone I have to authenticate with Outlook on my phone
Any Insurance company * (I say so because as an IT Administrator I'm forced to enable this to keep our cyber insurance policy, but I feel rather confident it's unnecessary given the research and our migration to ldap tied fido).
All I know is the mortgage servicing company I use seems to have started ~3 month interval, that they don't say (no second factor available either). When I went to pay my internet bill, I get greeted with a message "you're passwords been reset". I'm stubborn and I was just using those sites to pay bills, so now I just don't log in to those anymore.
Insurance, and government need to catch up to the research. For sites that support them, I really like the Yubikey as a second factor.
we have one piece of remote software that requires 90-day resets, but half the time the process is bugged so we end up having to have a new password relayed to us in the clear... through email. third-party email. it's only 100s of thousands of medical records on the other side of that login. no big.
Mine went to once a year for most systems. There is probably an external requirement somewhere that says they need to be changed periodically and once a year is the lowest frequency they can do.
Both companies I work for use Okta for 2fa AND also force us to change our passwords every 90 days, resulting in us using weak, easy to remember passwords. It's security theater.
I use a password manager, but I can't realistically use one on my work computer, because the computer is locked. You want me to open my password manager on my phone and try and type it in?
Yeah, I'm gonna continue to use the bare minimum password that meets the requirements knowing full well it can be brute forced in under 5 minutes.
Sure, but one strong complex password is much easier to maintain and remember than checks vault 71 individual logins each with unique complex passwords.
My password vault is also only accessible from my local network or from a device that's been within that network and logged in to my vault while it was there. (I'm not using public servers to sync between devices)