Password policy is overdone

[Cynthia Moore]

I always use very strong passwords, like "8UyTgFm,L;<kMkMkP-0O/", that are generated for me by the password manager I use. I never use the same password for more than one location.

The current password policy forcing me to change my password every 100 days (or whatever it is) is excessive and insulting. I participate in dozens of forums and I have accounts at several financial institutions, medical organizations, and online retailers. None of them require me to change my password at all -- ever. While I applaud your intention to minimize risk to your users, this policy is excessive, unnecessary, and pretty much non-existent elsewhere. If you insist on being an outlier, I suggest offering a bypass option. And I bet you have lost some subscribers because of the hassle to constantly change passwords.

[j7n]

Yes, I agree. I spent more than an hour trying to remember my password to change it. I couldn't do a reset. The change forces me to make passwords such as "passwordpassword1234abc" and I couldn't remember the "abc" I came up with the last time. Under the current system you also can't return to the previous password. I'm not sure if you can if you put one or two temporary ones.

This is a simple discussion forum, and it needs a second lowest password level in my opinion.

The forum is already deserted and this policy motivates people not to return.

[Bhikkhu Pesala]

It is something that I have learnt to live with. I save my passwords in a password protected text file on a Veracrypt password-protected virtual drive. Every 100 days I change my password for this website and update my text file.

If you have ever run a website, you will know that keeping it free from spammers is an onerous task that would make anyone quickly give up. Stefan enforced the strict policy to keep the place free from spammers, but I still have to manually remove a few spammers from time to time.

[j7n]

How is this related to spammers? Spammers post either immediately or after a short delay, perhaps a month, that is less than the password expiry interval of 200 days. They need a return on their advertising.

[Bhikkhu Pesala]

I emailed Stefan about this policy.