California State University, Fresno's IT department has implemented stringent password policies that require faculty to change passwords every three months, prohibiting the use of the last 12 passwords. This has led to frustration among faculty, who argue that such measures are unnecessary and cumbersome, especially since many have never experienced account compromises. Suggestions for coping with the rules include incrementally modifying existing passwords or using memorable phrases. The discussion highlights a broader critique of IT security practices, noting that overly complex password requirements can lead to insecure behaviors, such as writing passwords down or using predictable patterns. Participants shared experiences from various workplaces with similar policies, emphasizing the challenges of remembering multiple complex passwords and the ineffectiveness of such security measures. The conversation also touched on alternative security methods, like biometrics, and the paradox of increased security leading to decreased usability. Overall, the thread reflects a common sentiment that current password management practices may not effectively enhance security while complicating user experience.
As if the IT people don't hate me enough already. 