Loading…
19
DAE get chewed out by a sysadmin in Cleveland for reusing passwords, and now your whole login routine is different?
Back in March I sat in on a security review with a sysadmin out in Cleveland. When he pulled up the list of accounts I had tied to the same password, he leaned back and asked me one thing: "How many doors does one key open in your house?" That question stuck with me.
I went home and spent a Sunday changing every login over, one password per account, saved in a manager instead of a notebook. It took about 4 hours and annoyed me the whole time. But two weeks later a site I used got hit with a breach and I only had to swap one password instead of 30.
I still wonder what is the right way to rotate passwords now, since some folks swear by never changing them unless there is a breach. What does your setup look like?
1 comments
Log in to join the discussion
Log In1 Comment
claire9587h ago
Explain what made you land on never changing them unless there is a breach. I get the logic for random 20 character passwords in a manager, but what about the handful you still type by hand, like your phone unlock or the login for the manager itself? Do those get the same rule or do you treat them different? And when a breach does hit, how do you find out fast enough to act before someone uses the login?
3