[xname2]

Our university forces us to change the password every 150 days. It is such a pain in the s, because there are too many apps on too many devices need to update the password. I asked the IT department, can you guys consider to stop this and find an alternative security policy? The answer is no, because this security policy is in the state law.

[Fezzik]

If you're really hellbent on it, you can probably tell the IT department they are full of shit and ask for the citation to the state code number - I am no state code scholar, but I have never heard of anything like this. In the NW States I am familiar with I could not find a single code section that even remotely touched on passwords at state schools. It would be an odd thing to legislate. Some states are goofy though.

[eksemplar]

I work in the public sector in Denmark. Here three months is required by law.

It's caused our most common passwords to be things like Summer17 and half the employees that actually use what they think are hard random passwords end up writing them down.

If you look under the keyboard if 100 workstations you'll probably find 10 passwords on post-its.

It makes little sense too because if we're compromising for 3 months we're probably going to be just as fucked as if we were compromised for 4.

The best policy we have is locking people out after 3 wrong attempts.

[xname2]

Just checked, by a little bit of googling, I did find it in a gov document.

[nkristoffersen]

Care to share? Curious minds want to know :-)

[Fezzik]

I stand corrected. And intrigued that a state saw fit to make a law about that.