Forced Password Change Confusion

#1: Post by **yakster** » November 11th, 2021, 4:16 pm

Today while surfing the forum I selected Unread+ and was take to the user control panel. Everything I tried would take me to this page. Turned out after I scrolled down to the bottom of the page I saw a message in red that I'd have to change my password before continuing.

This message was at the bottom of the page and took me a while to notice, if you have any control over this placement, maybe you could move it up so it's more obvious what's going on. The page I was take to is the User Control Panel / Profile / Edit Account Settings.

I've changed my password now and things are back to normal. Thanks.

#2: Post by HB » November 11th, 2021, 4:35 pm

Maybe it's your font size or browser? Here's what the message looks like for me:

I agree that it'd be more friendly if it prompted you with an "OK" type message that then went to the page above. Sorry, that's the default phpBB implementation.

#3: Post by **ira** » November 11th, 2021, 4:43 pm

Can you please add the maximum password length in the the message that says minimum 6 character password?

Ira

#4: Post by **cafeIKE** » November 11th, 2021, 4:47 pm

<rant>
forced password changes do nothing to improve security
</rant>

Time to rethink mandatory password changes

FORCED PASSWORD CHANGING IS POOR POLICY AND REDUCES SECURITY

Microsoft says mandatory password changing is "ancient and obsolete"

November 11th, 2021, 4:49 pm

The message is under my long friends list box which is displayed on all the settings pages AFAIK. You need to get more friends, Dan.

#6: Post by **Jeff** » November 11th, 2021, 5:02 pm

Please confirm that the messaging around password content is correct. I tried several that met the stated criteria before finding one that was accepted.

#7: Post by HB » November 11th, 2021, 5:55 pm

Hmm-m. Since this appears to cause consternation among the site's most loyal members, I've disabled the password complexity and expiration.

#8: Post by **ira** » November 11th, 2021, 7:54 pm

Length is more important than complexity anyway. Personally I always put in the longest possible password, but if you don't say the max, what I'm I supposed to do. I would put in a 50 character if I could, but I've been burned to many time by sites that accept long passwords and then truncate them to 16 characters with no warning.

Ira

#9: Post by **PIXIllate** » November 11th, 2021, 8:12 pm

Length is the ONLY THING that makes passwords more secure. Special characters and capitol letters do NOT improve security. They DO make passwords harder to remember for us humans.

A sentence is a very strong password that can be remembered by people.

#10: Post by **ira** » November 11th, 2021, 8:15 pm

It's by far the most significant thing, but not the only thing. Larger character sets also help.