I saw a quote years ago about “common sense” that really changed the way I thought about it. I wish I could remember now where it came from.
“The problem with common sense is that it is common, not good.”
Lately I google for someone that should give me a direct, exact result. First five links are fucking paid ads.
For anyone that hasn’t read it, the book Surely You’re Joking Mr Feynman is a delightful read. Especially the bits about him fucking with security during the Manhattan project.
Well, considering the character is said to have been based on William Randolph Hearst, you’re probably quite right to be concerned.
You’re thinking of American Samoa which is different from the Independent State of Samoa, formerly known as Western Samoa and a sovereign nation.
https://en.m.wikipedia.org/wiki/Samoa https://en.m.wikipedia.org/wiki/American_Samoa
I really enjoyed reading 40k books when I was younger, but they’re generally shit writing. The kind of complete schlock that is good when you want to turn off the brain.
Seriously though, those looking amazing.
Well that just solved the question of “what should I watch tonight?”
deleted by creator
I always made sure I had Thomas guide book for any areas I went through in my car.
For anyone unfamiliar with the source.
Until you find out those were also built by a junior using an llm to help 🙃
BofA ATM where I live will do this now. They give you options of 10s, 20s, 100s, or “pick for me”
Hey, as a random Internet stranger I’m just going to say that I’m proud of you. Everyone has their own path to becoming a better them and I’m glad you’re doing the things that work for you. Keep it up!
You are correct.
For anyone else unaware, the schtick of the account was they’d always rate dogs with ratings of x/10 with x always being greater than 10. It was pretty funny how often people would get upset over this.
What you want is NIST 800-63b https://pages.nist.gov/800-63-3/sp800-63b.html#memsecret
Specifically sections 5.1.1.1 and 5.1.1.2.
Excerpt from 5.1.1.2 pertaining to complexity and rotation requirements:
Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets. Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.
Appendix A of the document contains their reasoning for changing from the previous common wisdom.
The tl;dr of their changes boil down to length is more important than any other factor when it comes to password security.
Edit to add:
In my personal opinion, organizations should be trying to move away from passwords as much as possible. If your IT team seems to think this system is so important that they need to rotate passwords every month, they should probably be transitioning to hardware security tokens, passkeys, or worst case, password with non-sms MFA.
Now I know nothing about the actual circumstances and I know there are plenty of reasons why that may not be possible in this specific case, but I’d feel remiss if I didn’t mention it.
This is what I grew up calling it was well.
Any organization still doing this is a decade behind best practices. NIST published new recommendations years ago that specified getting rid of the practice of regular forced password resets specifically because they encourage bad practices that make passwords weaker.
Of course it doesn’t help that there are some industry compliance standards that have refused to update their requirements, but I don’t know of any that would require monthly password changes.
I also really enjoy it!