Microsoft’s research team studied this extensively. They looked at what actually happens when you enforce complexity requirements. Users don’t create randomly generated passwords. They follow predictable patterns. Capital letter at the start. Numbers at the end. Exclamation point at the very end. The word “Password” appears in about eight percent of “complex” passwords. When you force rotation, users increment numbers. Summer2024 becomes Fall2024. Or they add exclamation points. Or they change a single character and call it done. The false sense of security is dangerous. IT departments see compliance numbers go up. Everyone is following the password policy. The auditors are happy. Meanwhile, actual security hasn’t improved at all.
here is the thing about working at a corp. I ask IT if there is a vetted password manager to use. They say they don’t have one. If I use one now im storing company passwords on unvetted software. thing is the corp has you do all this training and have you sign off you will keep to its guidelines.
Same. Where I work everyone switched to storing them in Excel.
Mine’re in onenote. First page in the section I have for each app. If they don’t have obscene password requirements that force me to generate random ones they’re in code at least. Otherwise… plain text.
yeah it kinda drives me bonkers. there is a security team and they have all sorts of things that don’t always make the most sense but they don’t insist the company get a centralize password manager solution.
Good god, that’s the exact conversation I had with IT