News for hackers. Stuff that matters.
Re:Password Rules Are Bullshit by lostlogin on Friday March 10, 2017 @11:12AM (#13839644)
Employee of a university here. Not only are the password requirements annoying, unless you close the browser you aren't logged out. Clicking "logout" makes it look logged out, but the next person to use email/payroll enters their credentials and gets the prior users account. Hilarity ensues with people applying for each other's leave, emailing responses to messages that weren't for them etc. The interim response is for people to set a theme in their email to make it more dictinctly different. I kid you not.
Re:Password Rules Are Bullshit by Spivak on Friday March 10, 2017 @04:00PM (#13842092)
Shibboleth user? I can't even imagine how difficult that kind of problem is when you're working with other people's software.

* Go to some service A.

* Get redirected to SSO and authenticate.

* SSO confirms your identity and A issues you a session token.

* You log out using your SSO.

* Go back to A where you're still logged in with your session token.

At a certain point I would not be willing to commit to maintaining lots of patches to every product we host and just tell our users to close their browser.

Re:Password Rules Are Bullshit by lostlogin on Friday March 10, 2017 @07:20PM (#13843318)
It's people soft and outlook, but I'll have a look at the single sign in page and see what that's done through.