1

At my workplace (and I am told many others), several password-requiring systems warn users every day during the two week period before their passwords expire. The warning consists of a dialog box that interrupts the login process with a message like "Your password will expire in 13 days. Would you like to change it now?" The annoyance and inefficiency is obvious: given three systems that do this, I'll have maybe thirty extra dialog boxes that I hit `cancel' on every quarter, plus all that time lost because the usual workflow of log in, get coffee, desktop will be up when I get back turns into log in, get coffee, realize dialog box is waiting, hit cancel, rearrange desk toys while desktop comes up.

But I can't fathom the benefit. Are there studies that have demonstrated that this improves security? Is having some percentage of users who succumb and change their password after 76 days instead of the usual 90-day expiration a real improvement, and if so, why not mandate that all users have to change their passwords after 76 days? Are there common cases where users will be locked out if they have to change their password post-expiration? There has to be a justification somewhere, but I'm just not seeing it.

Improve this question
4
  • 2
    Your story will be closed in 1 hour. Would you like to close and delete it now?
    – GregD
    Oct 8, 2011 at 14:01
  • 1
    I always assumed the prompt was to mitigate all users having to change their passwords on the same day. shrug. Dunno, I just change mine when first prompted.
    – jscott
    Oct 8, 2011 at 14:29
  • I see that my questions [Is there anything in the security literature on this? Are there common problems this avoids?] were deemed by several experienced users to generally not involve facts and to be likely to solicit opinion. Though I was hoping some solid reasons would turn up, I suppose that is an answer to my questions.
    – bk.
    Oct 8, 2011 at 15:00
  • @bk. We certainly welcome questions. I would like to point you to the FAQs: serverfault.com/faq which should help with any other questions you may have.
    – GregD
    Oct 8, 2011 at 15:04

1 Answer 1

Reset to default
2

The easy solution: Change your password as soon as the warning pops up :)

The major benefit I see is that there might be systems connected to the central account database that will fail to login the user if the password has expired but have no way of their own to perform the password change operation.

This might be the case for various web-based systems (i.e. web-mail), VPN solutions etc. which means that users trying to connect externally will have no chance to connect when their passwords are expired.

I even experienced similar problems with long-living system logins that didn't warn users upon expiring passwords and where the users afterwards (after the password expired) tried to connect to services and couldn't do so. Have fun debugging these...

So, my suggestion would be to maybe reduce the warning period, but only turn it off if all systems connected to your auth system can handle expired passwords correctly and otherwise, educate your users about the reason for the warning and tell them to not wait until the password is expired before actually changing it.

Improve this answer
1
  • Yes, my own experience, that every client I use can handle post-expiration password changes (including the webmail client), doesn't prove that there isn't a system out there somewhere that fails. Am a little concerned that there isn't actually anything that can't handle expired passwords, but the warning is on just in case.
    – bk.
    Oct 8, 2011 at 14:47

Not the answer you're looking for? Browse other questions tagged .