My password expired?

[Chattonne]

I I do tech support for an insurance company. Basically our customers can log onto our website to check on their coverage, make changes on their policy, etc, and I help people with technical problems on the website. Passwords for the site expire after 6 months. When that happens the customer gets a screen that says "Your password has expired. Click here to change your password." Today I got this call.

SC: I was trying to log in? And it says my password expired? Can you fix it?
Me: (sligtly confused as I'm not sure what the problem is). Are not able to change your password?
SC: No? (Everything he said was a question. Even answers to yes or no questions.)
Me: What happens when you try? Do you get an error message?
SC: Yes? It says my password has expired?
Me: Yes, and when you try to change your password, what happens?
SC: It ... says my password has expired?
Me: (Oh lordy, I've got a live one) Do you see where it says "Click here to change your password?
SC: Yes?
Me: Click there.
SC: Oh, so I just need to change my password? Thanks for your help? Bye?

Gah! Read the friggin' screen!

[WanderingSaint]

O_o.... My... my mind boggles at this.

... Someone neds soem coffee...

... and you need some cookies!

[VenomX]

I hate sites that expire passwords. No better way to lose me as a member/customer than to make me change my password.

[Broomjockey]

My school forces you to change your network password every 112 days. And you can't reuse passwords. I shudder to think how the IT staff gets treated because of it.

[jb17kx]

I hate sites that expire passwords. No better way to lose me as a member/customer than to make me change my password.

While it may seem very annoying, there are legitimate security reasons behind it. One can obtain your password in many ways, such as with keyloggers, packet interceptors, insecure databases, or even simple observation of your entering it. By forcing users to change passwords, it usually defeats these attempts as there is not enough time for them to be successful.

If they are successful, then that state of affairs lasts only 'till you notice or the next expiry.

So it's for your benefit in the end.

[Geek King]

I hate sites that expire passwords. No better way to lose me as a member/customer than to make me change my password.

I suggest you get used to the idea. I've worked with companies that issued me a electronic keyfob that had the current password on it. Why? Their password changed every ten minutes. High security medical facility, if you're curious.

[crazylegs]

I have a master password that logs me onto the work system them a further 3 inner passwords after that for various applications, however all four passwords expire after different lengths of time so in addition to the PIN to my radio, the code for the building, the pin to access vehicle keys I sometimes get slightly confused!

[VenomX]

While it may seem very annoying, there are legitimate security reasons behind it. One can obtain your password in many ways, such as with keyloggers, packet interceptors, insecure databases, or even simple observation of your entering it. By forcing users to change passwords, it usually defeats these attempts as there is not enough time for them to be successful.

If they are successful, then that state of affairs lasts only 'till you notice or the next expiry.

So it's for your benefit in the end.

I can understand it for banking and things like that.
But for a school web site?
But for a forum like this one?

[Dips]

OMG! I can really relate to the OP.

About 25% of my calls go like this:

Caller: My [software] says I need to activate? What do I do?

Me: Just go ahead and click the Activate button.

Caller: OH! [beat] Hey! It says I'm activated! Thanks!

Me: You're welcome.

I guess some people just feel the need to ask permission to do anything.

[technical.angel]

My school forces you to change your network password every 112 days. And you can't reuse passwords. I shudder to think how the IT staff gets treated because of it.

There's a thread around here somewhere that shows how.

[technical.angel]

I can understand it for banking and things like that.
But for a school web site?

School website would be usually for email or course management.

Course management usually has the student's financial and grade information. That right there is protected under FERPA, and that right there is some serious business.

Email passwords usually are the same logon as the network logon. If that got released into the wild, then you have the chance of an unauthorized user getting into the network, and then doing all kinds of nasty things.

All told though, I've never seen a forum that has required me to change my password.

[Rapscallion]

But for a forum like this one?

Oddly enough, this software is set up as default to force Admins to change their passwords every six months.

That should kill the thread

Rapscallion

[VenomX]

Oddly enough, this software is set up as default to force Admins to change their passwords every six months.

That should kill the thread

Rapscallion

I knew that since I run a vbulletin site/forum. Thats why I meantioned forums in my post.

[jb17kx]

As an aside, my bank - for online banking - makes me change my password every 3 months and use an RSA tag with a code that changes every 30 seconds based on an algorithm

So I have to put in the password and then transcribe an 8-digit code in the 30 second window to get in.

Annoying, but it adds an extra layer of complexity for anyone who wants to fuck with my meagre and insignificant finances.

[Fiyero]

Where I work we need a smart card, a pin number and 4 passwords (2 of which have to be changed frequently and must have letters numbers and nonalphanumeric characters, oh and be mixed case).
I am trained in data security so understand the need (the smart card and pin are for access to confidential patient data for the NHS) but during training it was recommended that we just change the number at the end! A good way to break the system.