Re: Current Best Practice regarding Password Change policy

[Valdis Kletnieks <Valdis.Kletnieks () VT EDU>]

On Fri, 24 Sep 2010 09:09:25 CDT, "Doty, Timothy T." said:

> Something I've always been curious about was the point of not allowing last
> X passwords to be re-used. Won't the user simply cycle through passwords
> (say, BadPassword1, BadPassword2, etc. or use a random password generator)
> until the one they want is out of the history?

Some systems enforce a *MINIMUM* number of days before a password can be
changed, to prevent that.  The well-designed ones allow that minimum to be
overridden in case a password is compromised.

And yes, I've seen some not-well-designed ones. :)

Attachment: _bin
Description: