News for hackers. Stuff that matters.

A comment on Microsoft says mandatory password changing is “ancient and obsolete” (2019). Parent comment

Re:Microsoft says mandatory password changing is “ancient an... by AdamJacobMuller on Monday April 19, 2021 @04:09PM (#26867400)
> You might be able to justify non-compliance with a compensating control, but I've never heard of anyone who tried it.

I just did similarly within a SOC2 audit. I sent the auditors a list of 50+ articles and references i've been maintaining for years saying that password changing is a bad idea (this article is on the list) from many different sources. I never heard back and the item was marked approved by them.

[ Parent | on HN ]
Re:Microsoft says mandatory password changing is “ancient an... by sadness3 on Monday April 19, 2021 @05:11PM (#26868031)
Can you please pop this list of articles into pastebin and paste it here? tyvm
[ Parent | on HN ]
Re:Microsoft says mandatory password changing is “ancient an... by technion on Monday April 19, 2021 @06:04PM (#26868420)
This hasn't been updated in a while but there's plenty of references:

https://gist.github.com/technion/65c652194fb1427e6828ea23ff4...

[ Parent | on HN ]
Re:Microsoft says mandatory password changing is “ancient an... by smallnamespace on Monday April 19, 2021 @05:07PM (#26868001)
Would you consider sharing it? Might be useful for others in the same boat.
[ Parent | on HN ]