Security Basics mailing list archives
RE: Password changes more than once per day
From: Joey Peloquin <jpelo1 () jcpenney com>
Date: Tue, 10 Feb 2004 18:08:41 -0600
Bob, It actually works in tandem with the 'Enforce Password History' setting, preventing users from resetting their password several times in a short period. For example, if Enforce Password History is set to remember 10 passwords, and the user's password has no minimum age, they could change their password 10 times, effectively allowing them to use the same password forever. Maybe it's time to remind the user *why* we have password policies in the first place? Sounds like they'd be happy to circumvent the policy altogether. Joey Peloquin
-----Original Message----- From: Bob Kelley [mailto:bob_kelley_jr () yahoo com] Sent: Tuesday, February 10, 2004 3:32 PM To: security-basics () securityfocus com Subject: Password changes more than once per day Can someone please explain the security implications of allowing a user to change their password more than one time per day without involving an account administrator? What's the risk ? I specified the security requirement of not allowing a user to change their password more than once per day for an outsourcing project and I am being asked why. I could not remember my reasoning other than it's a requirement for microsoft security policies to ensure password history is enforced.
[...]
The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. If the reader of this message is not the intended recipient, you are hereby notified that your access is unauthorized, and any review, dissemination, distribution or copying of this message including any attachments is strictly prohibited. If you are not the intended recipient, please contact the sender and delete the material from any computer.
--------------------------------------------------------------------------- Free trial: Astaro Security Linux -- firewall with Spam/Virus Protection Protect your network with the comprehensive security solution that integrates six applications for ease of use and lower TCO. Firewall - Virus protection - Spam protection - URL blocking - VPN - Wireless security. Download 30-day evaluation at: http://www.astaro.com/php/contact/securityfocus.php ----------------------------------------------------------------------------
Current thread:
- Password changes more than once per day Bob Kelley (Feb 10)
- Re: Password changes more than once per day Charlie Fraser (Feb 10)
- Re: Password changes more than once per day bauchi (Feb 10)
- RE: Password changes more than once per day Joey Peloquin (Feb 10)
- <Possible follow-ups>
- RE: Password changes more than once per day Pamela Gott (Feb 10)
- RE: Password changes more than once per day Gene LeDuc (Feb 10)
- RE: Password changes more than once per day Josh Mills (Feb 11)
- Re: Password changes more than once per day bsec (Feb 11)
- RE: Password changes more than once per day Gene LeDuc (Feb 12)