Ever had to change your password for no reason? Before, it was annoying. Now, it's useless.
Microsoft has admitted that one of the great curses of our time, the password reset rule, is nonsense.
"When humans are assigned or forced to create passwords that are hard to remember, too often they'll write them down where others can see them," Microsoft's Aaron Margosis wrote in a blog post Wednesday. Worse, Margosis wrote, when people are forced to change their passwords, too often they make a "small and predictable alteration to their existing password," or they'll just forget it.
The blog post introduces a broader set of "baseline" security settings Microsoft is considering recommending to companies that use its computer management software. Think of them as defaults of a sort.
Unfortunately, Microsoft isn't simply yanking the password reset feature, which would be the humane thing to do. In the end, it'll still be up to your company's tech team whether to listen to reason or continue living in the security Stone Age.
It's worth noting that Microsoft isn't changing recommendations around the way we create passwords. In fact, the company recommends companies increasingly ban typical bad passwords, and force employees to use multifactor authentication.
"Periodic password expiration is an ancient and obsolete mitigation of very low value," Margosis wrote.
But make no mistake, Microsoft, whose Windows software powers nearly 80% of the world's computers, has finally seen the light. Source
Post a Comment Blogger Facebook