Fucking hell.

And then they wonder that people resort to easily predictable patterns such as !1Qaz@2Wsx#3Edc and simply shift it one position to the right with every forced change and repeat at the end of the keyboard.

Tell them to move to yubikey or similar hardware key which is far more secure than any password policy will ever be and vastly more user friendly. Only downside is the intense shame if you manage to lose it.

The key should stick with the user thus not be stored with the computer when not in use. The key isn’t harmless of course but it takes a very deliberate targeting and advance knowledge about what it goes to and how it can be used. It’s also easy to remote revoke. If you’re extra special paranoid you could of course store the key locked at a separate site if you want nuclear codes levels of security.

This insane torture is why there are post-it notes under the keyboards.

And they believe all employees actually remember so many wildly different and long passwords, and change them regularly to wildly different ones? All this leads to is a single password that barely makes it over the minimum requirements, and a suffix for the stage (like 1 for boot, 2 for bitlocker etc), and then another suffix for the month they changed it. All of that then on sticky notes on the screen.

Yubi keys… for all logins, would solve this mess, geez.

This sounds like my old place, but much worse.

We used to have laptops we had to lock in a cabinet (yeah, one of those cabinets with a really puny lock that’s easy to pick). And we had to log into n old mainframe system that had numerous environment instances which each required a unique password that had to be changed every 90 days.

We (the software devs) basically rebelled on the laptop situation and insisted they find a better solution. Thankfully they changed policy and of allowed the laptops to be locked into our docking stations, which in turn were locked to our desks.

As for the mainframe system credential management, I tried using a standard third party password manager, but a) it wasn’t a good fit for the credentials, and b) the sys admins or security team forcibly uninstalled it because it wasn’t sanctioned software (even though it was a well-respected and actively maintained one). And our security group refused to go out and find one.

So being a dev, I wrote my own desktop password manager for the mainframe credentials. It was decently secure, but nowhere near as secure as a retail password manager. But it fit the quirks of the mainframe credentials requirements. And after my colleagues and manager did a code review of it, it was considered internal software, and thus fit for use.

As I was leaving they were in the process of removing all our local admin rights (without a clear path on how to accommodate for us developers debugging code - fun times ahead!).

But all of those annoyances pale in comparison to the shit you are having to deal with! Holy hell, that sounds like pure misery! I’m sorry.

Hahah, omg don’t they realize people are writing that shit down?

I’m big on proper security for business, but holy cow that’s nuts.

Guess I’ve been fortunate to work at some huge, well-known orgs that also really understood how to do these things.

One, in the 90’s,had already developed an early form of SSO for the 20 backend systems that all had unique username and password requirements. Their call center agents really appreciated it.

Modern day Kafka.

And I guarantee every one of those passwords are written on a piece of paper at the desk under the keyboard.

I was going.to auggest a hardware key, but I fear they would add it as another layer rather than as a replacement for this nonsense

This is very close to my workplace but we have about 17 domains to work across, with a separate account for each. It’s frustrating sometimes, but in the end I get paid the same either way.

My advice for this company: fire 2/3 of all IT staff (including managers). Then tell the remaining ones to cut off unneccessary things and do it better in the future.

Omg, my previous company did the same. But you missed a part. If you accidentally left out a real email, thinking it’s a scam, then the client will file a complaint.

I always click to see if the phishing email is real or not!

Gallagher were great at that, rubbish solution for “teaching” staff about phishing which would infuriate all staff caught in the net. Would come from internal email addresses too which, if one person’s email / credentials are compromised they’ve got bigger fish to fry.

Broken company mechanics in a nut shell

how do you think IT giants are enshittifying their services?

Who said security ever had to be difficult for the end-users? The companies that charge $15k per month per service to keep your company audit-ready. Oh and Microsoft is one of the more “seamless” providers for auth and security services out there, amazing.

When we do it right, you forget we’re here and we’re ok with that.

True words. The sustained effort to keep something in decent shape over years is not to be underestimated. Now when life changes and one is not able or willing anymore to invest that amount of time, ill-timed issues can become quite the burden. At one point I decided to cut down on that by doing a better founded setup, that does backup with easy rollback automatically, and updates semi-automatically. I rely on my server(s), and all from having this idea to having it decently implemented took me a number of months. Just because time for such activities is limited, and getting a complex and intertwined system like this reliably and fault tolerant automated and monitored is simply something else than spinning up a one off service

I mean it’s not the worst. Is it still https? Or are they serving plain ol http? My internal services (at home) are mostly https, but the certs are self signed so browsers will flag them as “insecure”.

I recently set up DNSSEC on my home domain, and I have been shocked to learn that none of my financial institutions use it. Going back through my logs, the only external host that even tries is api.weather.gov, and only for the CNAME pointing to a CDN host.

Lots of little things really. Obviously I couldn’t say for certain but they seemed to on top of it without causing us too much difficulty in doing our jobs.

Sometimes things were blocked like if a new email, or questioned after to check it was expected and followed policy. Policies were clear, and there were helpful prompts or warnings.

We were involved in something where we had to copy a sh*t load of files from a shared folder to a hard disk. There were like three automatic blocks that kicked in at different times, which was a pain at first to figure out but because we had a good reason, someone in IT just kept at it to get it done and looking back, that should have raised flags given the size of it all.

They changed from passwords changing every 6 months to no changes but had to be longer and mandatory 2FA. We were told to use keepass for all passwords for things that weren’t SSO for various reasons.