Ridiculous Requiremtent

[Rerun]

Our Techs and Nurses who go around and update our BP and put stats in the computers beside our chairs have a password and a pin they have to enter.  They have to change their pin every 3 hours..... yes HOURS.  That is such BS.  What, is some guy off the street going to sit there and guess passwords and pins and get my last Blood Pressure Reading?  That is just overkill They have enough to try and remember.  Plus it won't let them use a pin from the last 3 pins.  I hate, hate, extreme measures just to be micro managers.

[cassandra]

That's the weirdest thing I've heard in a while.

     

[Michael Murphy]

The truth about any passwords is that the more complex you make the rules the more people cheat and the easier systems are to break into.  My last job was at a Federal site.  Passwords were strictly Inforced but the real security was provided by a access card and a finger print scanner,  My major complaint up is that once a rule is created it is going to be there forever since no one will remove a rule no matter how inane it is. The don't use any of your last three pins likely creates the following scenario .  Every one is using 4 pins which are rotated in sequence.  Plus I believe if you look under all the keyboards you will find a list of pins. Overly strict password rules seem to actually weaken security.  The method I prefer is looking at login key stroke metrics, timings of logins tend to be the same for individuals.

[iolaire]

They have to change their pin every 3 hours..... yes HOURS.  That is such BS. 

I find that EXTREMLY hard to believe (but I do).  Even changing passwords every three months means you need to have a system and new passwords could be guessed from old.  I guess for those techs they will need to have a time based PIN and then reuse it every day so they don't forget (after 9 hours they can start over)...