News for hackers. Stuff that matters.

A comment on Lessons from a Professional Password Cracker. Parent comment

Re:Lessons from a Professional Password Cracker by macintux on Sunday September 25, 2022 @11:39PM (#32979124)
It gives added incentive to the company to make sure all of their internal passwords are managed via SSO so the users don’t continue to use a password on non-integrated systems after it’s rotated centrally.

And as long as employees are warned in advance, they should be aware of the risk of re-using passwords, which already exists today. If anything, this highlights the fact that if employees are using their company password for some other service, they’re placing their employer at risk.

[ Parent | on HN ]
Re:Lessons from a Professional Password Cracker by Arainach on Monday September 26, 2022 @01:11AM (#32979663)
Not all sites are customer sites.

I generally use unique passwords for everything, but I worked many years at a company with a 3-month password rotation policy, and coming up with high-entropy yet memorable passwords was sufficient work that many accounts on machines on my home network used some retired passwords from there.

[ Parent | on HN ]