Re: QPWDLVL 4, new with IBM i 7.5

Patrik,
I've seen these arguments too.
One problem I've seen with NOT requiring a password change is that
eventually people become paralyzed with fear of the ramifications of
changing their password. One prime example is a shared Windows
administrator account at one company I know of. They are not sure of all
the places it might be buried so they haven't changed it in decades. Even
though they've had turnover and some of the people who knew it have long
been gone.

On Mon, Feb 19, 2024 at 8:09 AM Patrik Schindler <poc@xxxxxxxxxx> wrote:

Hello Rob,

Am 19.02.2024 um 13:55 schrieb Rob Berendt <robertowenberendt@xxxxxxxxx>:

Perhaps a benefit of requiring frequent password changes.

IMHO the *only* benefit of enforced, regular password changes.

https://www.ncsc.gov.uk/blog-post/problems-forcing-regular-password-expiry

To not overly annoy users, I'd make this a one-time requirement.

But good to know IBM i adopts industry standard hashing for passwords
eventually.

:wq! PoC

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.