"Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically)."
-NIST Digital Identity Guidelines Section 5.1.1.2
Yet I cannot escape IT departments insisting upon it. Every time it happens I want to send them a "cybersecurity training module" right back at them.
Follow
@dpthorngren lol. I have had this in my email signature for a couple years at work
