Re: password reset required after migration to power 10 (v7r3 to v7r5)

And you're right about users trying to outwit the system.
The network fiend has domain access so he simply goes into Windows
admin and changes his password to the same one. Therefore the password
change date is updated.
In IBM i if you try CHGUSRPRF MYUSERPRF PASSWORD(entersamepasswordhere) it
does not update the password change date if the password is the same. Thus
that hack doesn't work. Not that this person has this capability on IBM i
but back when he did, it took me awhile to figure out why the autosyncer
wasn't working for him and his passwords kept expiring.

On Mon, Mar 17, 2025 at 11:13 AM Patrik Schindler <poc@xxxxxxxxxx> wrote:

Hello,

Am 17.03.2025 um 14:12 schrieb smith5646midrange@xxxxxxxxx:

I read the attached article and IMO, that it the dumbest thing I have

ever read.


These are harsh words. What exactly is triggering your perception?

Saying to never change ANYONE'S password because a few people can't

remember a new password or it will be similar to a previous password is
crazy.

I'm not saying no to never change anyones password ever. I'm saying that
changes should just not be enforced by a simple timer. If a user wants to
change his password, he should be allowed to do so.

Users will try to outwit the system, to get away with the least change
ever. No matter rules you impose. And the more rules you impose, and the
more often a user needs to come up with trying yet another possible
password, becoming more and more upset about this obstacle, hindering him
from doing actual work.

Forcing repeated changes makes user's life miserable and provides no
additional security, unless the user had a postit stuck to his screen.
Which he should not have done in the first place.

Also, read this: https://xkcd.com/936/

The more important part is disabling unused accounts.

Yes, definitely!

My account was still active and I was able to log in 3 years later.

For them, it was helpful, but is bad practice.

:wq! PoC


--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.