TIL password complexity rules are mostly theater

I spent years forcing people to use symbols and 90-day rotations until I saw a coworker tape his new complex password to his monitor. That's when I realized we were just making security theater, not actual security. Has anyone else had their assumptions challenged by seeing how real users actually behave?

2 comments

2 Comments

dylan4635d ago

Did your coworker really tape it to the monitor? I had a guy write his password on a sticky note and put it under his keyboard... like that was some kind of secret hiding spot. Security theater is real. We made this one lady change her password every month and she just rotated between Summer2022, Fall2022, Winter2022, Spring2023. She was not fooling anyone. Now I just tell people to use a long phrase they can remember instead of that short symbol mess.

henry_ross5d ago

Man, that password rotation thing is a joke. @dylan463 hit the nail on the head with those seasonal passwords, we had a guy at my old job who literally used "Password1" and then "Password2" like a countdown. I swear, the only thing those rules do is make people write their passwords on a sticky note and call it a day.