posted in Technology
A rant about phishing: It's not the user's fault (and not DNS either)
maurycyz.com/misc/domains/Replying to @lemmydividebyzero@reddthat.com
IT department: ”A clear telltale sign of phishing is the sense of urgency. Official IT department email will never panic you into clicking strange links”
Also IT department: ”YOUR PASSWORD IS EXPIRING IN 24 HOURS!!! CLICK THIS STRANGE LINK NOW TO RESET YOUR PASSWORD!!!”
Replying to @red_tomato@lemmy.world
24 hours, my IT department sends them out at 28 days!
It’s so stupid, and they still write the email as if it’s happening immediately.
Replying to @red_tomato@lemmy.world
Exactly right. And the reasoning here is that the IT department is in no rush because they don’t care if your password expires, so what.
At some point the password will fail to work and you’ll be prompted to pick a new one. Either you’ll update it and log in, or you won’t, IT doesn’t care.
Replying to @Cocodapuf@lemmy.world
Wait, IT was supposed to care at some point?
Replying to @red_tomato@lemmy.world
We simply don’t expire passwords regularly. We have Entra require a reset if it sees something suspicious. Other than that and manual “reset because suspicious”, your password can last forever.
Replying to @red_tomato@lemmy.world
We did 30 days, 15 days, one week, and 24 hours. And still, we’d have users get locked out for not changing their password or calling us in a panic because they only saw the 24hr notif. We switched over to only requiring changes when entra saw something fishy, which definitely lowered stress levels.