🚀 go-pugleaf

ts@cup.portal.com (Tim W Smith) writes:

>> But even with this, we got squawks about "why do we need to change
>> passwords every 90 days?" (we couldn't push a shorter interval on them).
>> And we had people who insisted on being able to re-use passwords. 
>> 
>> Unless you can get the users to *care* about security, they aren't
>> going to bother.

>Has anyone shown that forcing users to change passwords every so often
>actually makes things more secure?  Isn't frequent changing of passwords
>just going to make it more likely that users will write down the passwords
>somewhere?

Well, there *are* reasons why you pretty much *have* to do periodic
changes or accept ever increasing loss of security.

We *knew* that people would give out their passwords to other users. Even
though this was very much *against* policy. by changing the passwords we
at least chopped off those "holes" every so often. Note that we were *trying*
to get users to use the "grant" command, which could be used to give 
another account specific access rights in a users files ort directories. 
It was prefffered because ypu can easily *list* who you've given what rights 
to (the TLIST command). 

We may have had some problems *due to* the changes. But we know that they
closed the holes at least temporarily. The users weren't doing a "I'll
share my password with Joe", instead it'd be something like Joe saying
"Hey, where's that report, I need it!" and the user giving Joe their 
password instead of loggining in and granting access or copying it to
a directory joe had access to.

-- 
Leonard Erickson		      leonard@qiclab.scn.rain.com
CIS: [70465,203]			 70465.203@compuserve.com
FIDO:   1:105/56	 Leonard.Erickson@f56.n105.z1.fidonet.org
(The CIS address is checked daily. The others infrequently)