Implementing "password never expires"

on YouTube ↗23m

" summary

Organization implements a voluntary password never expires policy for 1,400 internal accounts, sets minimum length to 16 characters while keeping complexity, and builds a secure virtual server plus a PowerShell extractor to pull AD hashes (no username linkage). An offline password audit compares hashes to Have I Been Pwned and runs dictionary/Princeprocessor/combinator attacks with custom rule sets; monitoring and alerting find three policy-migration mistakes so far and one patient-record app rejects >14‑char passwords, so rollout is partial but operational.

AI-written summary · about

" chapters (7)

1. 0:00Introduction
2. 3:00Why do you implement this
3. 5:00Why did you do this
4. 6:50The implementation process
5. 10:48The offline password
6. 12:45Challenges
7. 16:32Problems

" related talks

• 31mBreaking Bad (Passwords)Hamed Merati, Willem Mouton · RSAC 2020 Asia Pacific & Japan
• 01h 05mPasswords are not going awayPer Thorsheim · NDC Security 2022
• 40mFantastic Passwords and Where to Find ThemPhil Nash · NoRuKo 2020
• 11mEvolution of Password Expiry in Companies: Measuring the Adoption of Recommendations...Matthew Smith, Maximilian Häring, Christian Tiefenau, Eva Gerlitz · SOUPS 2023
• 05mPlease do not use !?_ or your License Plate Number: Analyzing Password Policies inMatthew Smith, Maximilian Häring, Eva Gerlitz · SOUPS 2021
• 23mFantastic Passwords and Where to Find ThemPhil Nash · WFH Conf 2020
• 30mhunter2: A Symphony of Password HorrorLilly Ryan · PyCon AU 2017
• 46mRequiem for the PasswordSteven Kriby · BSides Huntsville 2021