Timeline for Requiring regular password change but storing previous passwords?
Current License: CC BY-SA 3.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 17, 2017 at 10:46 | history | edited | CommunityBot |
replaced http://security.stackexchange.com/ with https://security.stackexchange.com/
|
|
| Sep 10, 2016 at 20:31 | vote | accept | IMB | ||
| Aug 31, 2012 at 1:08 | history | edited | Tom Leek | CC BY-SA 3.0 |
added 2 characters in body
|
| Aug 30, 2012 at 16:36 | comment | added | Simon Richter | Oh, and it works around broken replication. | |
| Aug 30, 2012 at 16:35 | comment | added | Simon Richter | The minimum time would protect against smart people who know that they only have to change their password 24 times in order to be allowed their old one. | |
| Aug 30, 2012 at 12:48 | comment | added | Iszi | Just checked. NIST says 60 days expiration, 24 password history. CIS has the same password history, with 90 days expiration. 42 day expiration and 24 password history is actually Windows' default. Since the Windows defaults are technically compliant in this regard, some System Administrators just don't bother changing them. NIST and CIS both recommend a 1 day minimum password life - Windows default is zero. I really don't know who goes for 3 days minimum. | |
| Aug 30, 2012 at 12:42 | comment | added | Iszi | Wow. Three days? I've heard of restricting to change only once per day, but I don't quite understand three days. 42 day expiration and 24 password history is a common standard, though. I forget whether I saw it in NIST or CIS, or both. | |
| Aug 30, 2012 at 12:39 | history | edited | Iszi | CC BY-SA 3.0 |
added 7 characters in body
|
| Aug 30, 2012 at 12:20 | comment | added | adric | The strange windows of when you can update passwords are designed to prevent you cycling back around to your 'favourite' passwords after every required change. In the environment you describe (history 24, wow) this may not be a valid concern. | |
| Aug 30, 2012 at 12:05 | comment | added | ewanm89 | So, if password is compromised within 3 days you can't help fix it by changing the password? | |
| Aug 30, 2012 at 11:41 | history | answered | Tom Leek | CC BY-SA 3.0 |