Monitor use of old passwords

Posted Aug 25, 2021 18:10 UTC (Wed) by rgmoore (✭ supporter ✭, #75)
In reply to: Monitor use of old passwords by mathstuf
Parent article: Adding a "duress" password with PAM Duress

If your employer cares

I think we've hit the root cause of my problems right here. My employer, like so many others, seems to operate on a combination of hunches and out of date information when deciding this kind of security policy. It's odd, because for remote connections- including accessing email remotely- they've adopted an app-based 2FA that seems like it's much more in step with modern security recommendations. They could add a whole lot more security by going to 2FA for all logins than with all their security theater around passwords.