New Stupid Password Policy

Dear Lisa Smith,
Nothing personal but your new password policy is the dumbest thing I have ever seen in my 20 years in the IT world. I am a Sr IT security officer and I am deeply worried about your security practice.
I could create a 100 character password and it would still be hacked if you can't lock down your password db. 8 Characters will do if you have a lock out in place after three attempts... Other wise I can change my password daily and they will laugh as they watch me change it.

Hello and welcome to the forum jimwill47,
I'm very sorry to hear you are frustrated with our new password system. The change was made in an effort to increase security on all BestBuy.com accounts. I sincerely apologize if this change has caused you worry instead.
I appreciate you taking the time to post your feedback, and I assure you I will be documenting your concerns to forward them to our internal leadership team. A password lock out does seem like a good idea, and it is through this kind of feedback from our customers that we are able to focus on the areas that might have an opportunity for improvement.
Once again, I am very sorry for any frustration this may have caused, and thank you again for posting your feedback here on the forum.
Respectfully,
Maria|Social Media Specialist | Best Buy® Corporate
Private Message

Similar Messages

Introducing a custom Password policy to expire passwords. odsee 11g - what are the expected results

We have left the default Password Policy untouched. As a default password aging is off. Our DS compatibility mode is now DS6 so we can add Password Policies with max age!
Some users need to have their passwords changed regularly due to political reasons.
We have introduced a custom Password Policy which has a pwd_Max_age value of 180 days and allows the user to Change Password. Entry is cn=Custom Pwd Policy for ABC,dc=mycorp,dc=com
Ok. Now we get confused by the behaviour of this ODSEE 11g server. Now, we are ADDING a new custom Password Policy to just a few selected users!
1. When we add the Policy to the user by setting the passwordpolicysubentry attribute = "cn=Custom Pwd Policy for ABC,dc=mycorp,dc=com"
- Nothing seems to happen.
- WHEN IS THE PASSWORD EXPIRED?
2. After we change a password for a user who has the passwordpolicysubentry attribute, he gains a new attribute pwdChangedTime
- IS THIS THE ONLY TIME THE EXPIRY CLOCK STARTS TICKING? *AFTER* THE PASSWORD IS CHANGED?
3. Is it true, that if a user never changes his password, even if he gets the new custom password policy applied, his password never automatically expires????
I just cannot work out what is supposed to happen. I would have hoped that at the very least, the password begins to expires as soon as he gets a Password Policy with pwd_Max_age set.
How is ODSEE 11g designed/supposed to function.
Help!!!!!
*HH

Sylvain ,Many thanks for your reply and suggestions. Always good to have a choice!
So it seems the only way to get the password aging clock to tick is for the password to be changed after having the password policy applied.
Option1 is not really an option although it certainly would make the users change the password and set up the password aging...
The main difficulty with odsee 11g (Version 11.1.1.7.0) is that pwdChangedTime is a system read-only attribute linked to a modification to userPassword attribute, I cannot use ldapmodify to add/modify the pwdChangedTime attribute.
I was amazed that I can read/store the userpassword as the base64 string and replace the userpassword attribute with this value using ldapmodify. This is very easy (and works!) but will cause the pwdChangedTime attribute to contain the same time for all users. I can imagine helpdesk loving it when everyone calls them in 6 months time.
Using the LDIF backup/restore utility looks the best option, if it succeeds. At least we can randomize the actual value of pwdChangedTime with this approach.
Mercy Buckets.

How to create new password policy in FIM

Can anyone assist me is there any way to create a new password policy in fim similar to creating password policy in OIM.Any related inforamtion is useful and appreciated.

Ref to below Link it might give you some idea:
http://www.iamblogg.com/password-policy-violation-exporting-to-ad-from-fim-2010/
Regards~
Deepak Arora
If you Find the Answer | Article | Blog Helpful Please Vote As Helpful / Mark As Answer

New users with Global Password Policy requiring password "reset on first user login" are still prompted to reset password after entering incorrect password

The setup:
We have the option "Password must: be reset on first user login" enabled in the Global Password Policy on our 10.9 / Mavericks server. We import new user accounts into Open Directory via a delimited text file and include a default password for each user.
What I've observed and tested:
When a user attempts to log into a computer that's bound to our Open Directory for the first time, they can enter anything in the password field and still receive the prompt to reset their password. They are never notified that they entered their default password incorrectly. The password reset will then fail (as it should), but they still aren't notified that this is the reason for the password reset failure. To put it another way: Seeing the prompt to reset your password would reasonably imply that you entered the default password correctly, but that's not the case at all.
The question:
Is this expected behavior? If it is, it doesn't seem logical. If this was the case in OS X Server 10.3 through 10.7 I never noticed it. Can anyone corroborate this with their own setup? Thanks in advance.
-- Steve

Some follow up questions:
- How did you migrate (dsmig ldif or binary import)
- Did the accounts in .x have any custom password policies set?
For a "new" and a migrated entry, can you check if a passwordpolicysubentry is configured?
(search as directory manager and fetch the attribute)

How to add new password policy to cn=config via LDIF file

I am trying to add a new password policy called "Service Password Policy". I have the following LDIF file:
dn: cn=Sservice Password Policy,cn=config
changetype: add
objectClass: top
objectClass: passwordPolicy
cn: Service Password Policy
description: A password policy intended for proxy or service accounts.
passwordMustChange: off
passwordChange: off
passwordMinAge: 0
passwordInHistory: 0
passwordExp: off
passwordMaxAge: 2142720000
passwordWarning: 0
passwordExpireWithoutWarning: off
passwordCheckSyntax: off
passwordMinLength: 6
passwordRootdnMayBypassModsChecks: off
passwordStorageScheme: ssha
passwordLockout: off
passwordMaxFailure: 32700
passwordUnlock: on
I've tried various permutations of this command:
dsconf import -h localhost -p 1389 /root/createServicePasswordPolicy.ldif "cn=Service Password Policy,cn=config"
I get this error:
"cn=config": suffix does not exist.
The "import" operation failed on "localhost:1389".
Thx for any help,
CC

Good it did not work or you would have overwritten all the data currently in cn=config. Anyway, "dsconf import" only works on regular backends. The cn=config tree is special a.
You should use ldapmodify to add the contents to cn=config.
$ ldapmodify -p 1389 -D cn=root -f a.ldif -a

What is the new password policy?

What is your new password policy? All you state on the page where it forces us to change without being able to continue is a meter that says whether its strong enough. How about actually stating what the requirements are on that page? Even when clicking on the Password Help link, it doesn’t state what the requirements are. This can be very frustrating to users trying to create a password model.
After toying around with some passwords, I am guessing it is just like 12 characters regardless of whether they are upper/lower case, numbers, or special characters. This policy is really lacking for any type of real security measure.

Hello tmanXX,
Internet security is a topic of much importance and discussion these days. In order to ensure that you and our other customers have the most enjoyable and secure experience, we recently established new requirements for passwords on BestBuy.com. Even so, you ask very good questions about the standards that we have established.
When changing your password on our website, we have a visual indicator to verify your password strength against our criteria. We recommend a variety of letters (upper and lower case), numerals, and symbols deployed randomly for best results. Our standards are not published to add a further obstacle to those who might try to use such information with ill intent. I apologize for any aggravation that you may have endured as a result.
Please know that I'm grateful for your feedback on our password standards and that you took the time to pose your questions and concerns.
Sincerely,
John|Social Media Specialist | Best Buy® Corporate
Private Message

Implement new password policy

Long story short, inherited an existing domain that has this below in place for their password policy. I really need to get them into alignment with us, so I need to change this policy to the second one below. But I know if just went and changed
those settings, every user(there are only about 30 users) would get prompted to change their password the next time they logged in. The domain is 2003, so I know that fine grain is not an option. Is there anything I can do to lessen the blow,
maybe some kind of script that changes the password last set or something like that?? I went and looked at the attribute on a few of these users, they haven't been set in about 8 years.
Enforce password history   0 passwords remembered
Maximum password age   0 days
Minimum password age   0 days
Minimum password length   4 characters
Password must meet complexity requirements   Disabled
Store passwords using reversible encryption Disabled
Enforce password history   10 passwords remembered
Maximum password age 60 days
Minimum password age    1 days
Minimum password length   8 characters
Password must meet complexity requirements   Enabled
Store passwords using reversible encryption   Disabled

"Lessen the blow" ??
Do you mean for you (the admin who would need to deal with lockouts/resets)?
Or do you mean for the 30 users ?
I'd suggest that you try to implement in as few steps as possible. In my experience, progressively enabling password policy settings can be very confusing for end-users, when done in several phases.
Keep it to two phases, is my advice.
1) enable everything except aging/expiry
2) encourage/warn your users that new criteria are in place (length, strength, etc)
3) encourage your users to manually perform password change. This familiarises them with the length/strength requirements, and, you'll get them doing it at slightly different times, allowing them, and you, to handle the volume of assistance calls.
4) enable aging after a few days or two weeks. This means that users who have opted-in early, will only need to deal with the expiry window in ~60 days, and will have been through it recently, and so will be familiar.
Those users who didn't opt-in early via manual password change, will be hit with a forced-change and all-new length/strength concepts to deal with all at once. And you'll get calls from those people, because the Windows password policy dialogs/messages are
quite awful.
Also, consider the impact of your existing (or proposed) account lockout settings.
If these users are technically-savvy (eg are software developers or whatever), they may have many logon sessions running, many devices with cached accounts, etc - this can cause a spike in your account-lockouts, and users who haven't changed passwords in a
long time, often have many cached/saved/stored/concurrent sessions.
We have around 1000 calls at helpdesk for password resets/unlocks per week in our estate. We do have a self-service password reset service. We still get calls. We introduced similar password policies to you, more than 10 years ago. It still causes hellish
Monday spikes in reset/unlock calls.
sigh.
Don
(Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

Adding new password policy rules

Can you add new password policy rules in OID 902?
I wish to prevent users from entering a new password that matches their previous 5 passwords.
Can this be done at all?
Regards,
John

We recently put in a password policy that makes everyone change it every 90 days. This last week was the first time everyone's had to update their password, and we ran into a few issues.We've got over 150 users so I don't know if it's user error or what, but I've had half a dozen people over the last couple days say that they changed their password, and now they can't log into the computer. I end up resetting it for them, and then they're good to go again. I feel like maybe they aren't remembering what they set their password to.Also, another half dozen people so far have complained that their phones aren't syncing mail after changing their password. They said they put the new password into their phone, so it should just keep going... but nothing. Some are fixed by removing the profile and re-adding, others I have to go and delete...
This topic first appeared in the Spiceworks Community

How to add a new password policy

This must be simple, but appearantly nobady has conceeded:
"how does one add a NEW password policy to the OID?"
I need this functionality, because I want to enforce the following rules in my SSO application:
- 99% of the users may have passwords that never expire
- 1% (say 5 or 6) users must have passwords that do expire, because they are super users and we want to minimize the risk of their passwords getting in the wrong hands.
I feel almost embarrased to post this question, but I really cannot find any example or documentation that shows me how to add a new password policy.
Is their any way to do this in OID?

Hi,
Can you please provide exact steps those were used to create password policies for users.
I opened a Tar with metalink on this , and they told me that this way is not supported by Oracle.
So if you can please help me with this it will be great. See the details about the Tar as below:
11-AUG-05 21:41:42 GMT
QUESTION
=========
How to create or add a password policy for users in OID according to forum 833683 ?
RESEARCH
=========
- Re: How to add a new password policy
- Oracle Internet Directory Administrators Guide Release 9.2 Chapter 17 "Password Policies"
ANSWER
=======
Oracle Technical Support does not support to create password policies for specific users. Orac
le Internet Directory provides a Password Policy for each subscriber created (al
so known as Realm) or for the entire DIT.
eos (end of section)
I talked with the customer and she agreed to close this TAR.
Best Regards,
Hector Viveros
Oracle Identity Management
@HCL
.

New password policy causing major headaches

So I was watching a Tedx youtube video the other day that was all about memory.To sum it up, if you create a policy for password (in this case) send out a email to the company about how to make passwords fun. Include a collage of random pictures to help users create new passwords.Collage list from GoogleFun items are much much much easier to remember.So if I had to make a new password as a user, I'd create something fun with the collage and generate a password from that.

We recently put in a password policy that makes everyone change it every 90 days. This last week was the first time everyone's had to update their password, and we ran into a few issues.We've got over 150 users so I don't know if it's user error or what, but I've had half a dozen people over the last couple days say that they changed their password, and now they can't log into the computer. I end up resetting it for them, and then they're good to go again. I feel like maybe they aren't remembering what they set their password to.Also, another half dozen people so far have complained that their phones aren't syncing mail after changing their password. They said they put the new password into their phone, so it should just keep going... but nothing. Some are fixed by removing the profile and re-adding, others I have to go and delete...
This topic first appeared in the Spiceworks Community

Creating a new Password Policy

I am running a Windows 2012 Datacenter domain with Exchange 2013 as a member server. 100% of my users are Outlook Anywhere or OWA users that only use email, so they do not login to the domain on their PC's. I want to create a User password policy and
apply it to specific OU's to force users to change their passwords every 180 days. But I see two issues. One is the Default Domain Policy that is applied to the entire domain, and the other is that it appears that you can only apply a password
policy to a system and not a user.
Does anyone have any guidance or advise. TIA
Larry
Larry D.

I believe what you're looking for is a fine-grained password policy.
Step1 - Create the Policy
http://technet.microsoft.com/en-us/library/cc754461(v=ws.10).aspx Of these options, I recommend using ADSI
Step2 -Linking the Policy
http://technet.microsoft.com/en-us/library/cc731589(v=ws.10).aspx Of these options, I recommend using AD Users & Computers
Hope this helps.

How to ignore the password policy in a custom workflow?

Hi,
We have a custom workflow which is called via SPML to provide 'Administrator Change Password' functionality in a portal.
Our password policy sets the String Quality rules and Number of Previous Passwords that Cannot be Reused. But we like to bypass the password policy when the password administrators (who have a admin role with a capability - 'Change Password Administrator'). At least, restriction ' Number of Previous Passwords that Cannot be Reused' need to be ignored (But password need to be added to the history... cannot disable adding passwords to history).
Please advice me how it could be achieved?
The workflow steps:
1. Checkout 'ChangeUserPassword' view for the user as an administrator
2. Set the new password in the view, set true to view.savePasswordHistory
3. Set password on the resources
4.Checkin the view
Thanks
Siva

Thanks eTech.
My main goal is to skip the password history check (new password can't be a last used 10 passwords) when admin change password workflow is launched. As you suggested , I created a special password policy exactly as our regular password policy excluding "Number of Previous Passwords that Cannot be Reused" setting.
Then before change the password of a user as admin, special policy is attached , password changed, and user's password policy is reverted back to regular one. The issue is, as the special policy does not enforce the password history check, the whole password history of the user is wiped out from the user object when the password is changed by admin change password workflow. We don't want this to happen.
Please guide me whether is anyway to achieve just ignoring the password history without any other impact on user.
Is adding passwords to user object's password history list is triggered by "Number of Previous Passwords that Cannot be Reused" setting of the password policy??
Thanks
Siva

Script for generate randomize administrator password which make log file to recorded new administrator password with associated computer name on it

Hi
I Need VDS script in order to change domain client local administrator password in my domain ,and put this script in startup script via group policy, but for security purpose I want to randomize local administrator password and log new password
set for each computer on a text file, I want to over write the old password of eachcomputer in log file with new one in order to have the update log file ,my support team some times need administrator password for troubleshooting.
I need a script for generate randomize administrator password which make log file to recorded new administrator password with associated computer name on it and each time new administrator password set it over write the old record on
the log file and update the content of log file automatically.
Regards

Hi
I need a script for generate randomize administrator password which record new password on a log file with associated computer name and each time new administrator password set for a computer it over write the old record
on the log file and update the content of log file automatically.
Regards

How to implement forgot password policy in OIM

Hi,
I want to implement forgot password Policy on OIM 11g r1.
Can any one please help me on this.
I mean from where to start and how is the follows goes..
Thanks in Advance :-)

Forgot Password functionality is OOTB.
You can configure Forgot Password Question Answers. Go to System Configuration (Advance Console) and search for different properties associated with Challenge Questions Answers.
OIM.DisableChallengeQuestions
PCQ.NO_OF_CORRECT_ANSWERS
XL.IsDupResponseAllowed
etc..
You can also add new Challenge Questions as well by adding into Lookup.WebClient.Questions

Configure a Password Policy

Hi All,
i want to have a password policy for the database. As I found, there's a default table called dba_profiles where we can set password properties for the default database profile in 11g. Actual requirement is to change the sys user's password in every one month time. can i do that using this dba_profiles table?
And there's another problem. we have another 10, 12 dba users with different passwords. so if i do some change to the default profile will it affect whole the dba users..??? because i cant change other db users passwords since the application totally depends on that passwords..... :S
Can anybody give me a hand to do this please...... if i'm wrong..plss correct me. And if you have any other systematic way to configure a password policy, please let me know....
Thanks in Advance,
Max

Max wrote:
Hi All,
i want to have a password policy for the database. As I found, there's a default table called dba_profiles where we can set password properties for the default database profile in 11g. Actual requirement is to change the sys user's password in every one month time. can i do that using this dba_profiles table?
DBA_PROFILES is just data dictionary view.But there is a term PROFILES which you can manage user`s passwords and other resources(like max_idle_time).Of course you can use profiles.
And there's another problem. we have another 10, 12 dba users with different passwords. so if i do some change to the default profile will it affect whole the dba users..??? Yes it will effect other users which assign default profile(default profile is a default for all users you can see that after user creating dba_users.profile column).I suggest you do not change DEFAULT PROFILE settings.So create new your own profile using CREATE PROFILE LIMIT ... clause and assign this to users.
because i cant change other db users passwords since the application totally depends on that passwords..... :S
Can anybody give me a hand to do this please...... if i'm wrong..plss correct me. And if you have any other systematic way to configure a password policy, please let me know....
If you want implement different password policy for different users then create two or more profiles and use these.
Remember that to implementing profiles setting the RESOURCE_LIMIT initialization parameter must be TRUE.
http://download.oracle.com/docs/cd/B19306_01/server.102/b14200/statements_6010.htm

New Stupid Password Policy

Similar Messages

Maybe you are looking for