2

Like many, I am required to change my password periodically. When it is about to expire, I am notified on the logon screen (I connect via VPN), but this notification begins two weeks (14 days) before my password will expire. Additionally, this notification consists of: "Your password will expire in nnn days. Click here to continue".

I find this somewhat intrusive, especially the "click here to continue". Is there a reason for this that I am not considering? Why is notification required at all other than after my password has actually expired?

Update

Based on the responses so far, it seems like a clarification is in order.

  1. This is a system logon, not to a particular application, although the more I think about it, the less important that distinction becomes
  2. My passwords expire after 90 days. After expiration, I cannot log on until I create a new password (which also requires entry of the "old" expired password).
  3. There is no difference in creating a new password beforehand or after the password has expired.
  4. Between days 74 - 90, I cannot log on until I click the link.
  5. The "link" does not bring me to a page where I can change my password. It seems to be just a confirmation that I have seen the particular message.
1

My workplace has a similar policy, and I can give you our reasoning for it (I'm in the IT department):

  1. Although the policy is set to 14 days, users are really only notified for 10 weekdays as not all staff work weekends.
  2. Giving you a 14-day window to change the password prevents excuses of "I didn't realize it was about to expire".
  3. 2 weeks allows for users on vacation to return with enough time to still change their password (my org requires full-time employees to take 5 consecutive week days, plus the weekend before and after, off per year for "compliance").
  4. Due to propagation issues, the expired password may not allow users to change it themselves and requires involvement from IT to reset the password manually.
  5. The system cannot force you to change the password early (otherwise the expiration date is not 90 days), so the "Click here to continue" allows you to dismiss the message until the expiration date is reached while still providing the reminder.

Even with all that, we still have users who refuse to change their passwords until after it expires and are forced to call us to reset it. We've gotten to the point that the system emails the employee and their manager every day for those 14 days reminding them to change it.

Overkill? Maybe, but we do seem to be getting fewer calls to reset expired passwords.

  • Thanks. It seems like item 4. above is the reason. We do not seem to have that problem. I've am able to create a new password at least a week (coming back from Vacation, as you noted) after the old one has expired. – Michael J. Apr 1 '16 at 17:19
1

Advanced notifications are good

People don't like to be surprised. They want to know an event is on the horizon. This helps mitigate anxiety when the day finally comes and the application says "you can't come in here!".

Not everyone handles this in the same way. Some people like to take care of such requirements the minute they arrive. Others are procrastinators and would rather get the most out of the password they have.

With system sign-in creds, there are some considerations:

  • An error in last minute password changes may block important work.
  • The user may need to update the credentials in multiple locations (desktop, phone, laptop).
  • A user may be leaving town and want reasonable lead time before expiration.

Don't block the users

The key word is notification. You do not want to block the user from their normal sign in flow. Present the information at sign in so the user is aware and has the option to take action, but can also proceed as usual if they choose.

Where there is concern that a user may not sign in for an extended period of time, email notifications are also appropriate. Same principles: they should be able but not required to take action.

0

In many cases, changing the password after it has expired is a way more painful process than changing it in advance, when you still do have access to your account using the old password.

  • 1
    In my case, changing a password after it has expired is no different than changing it beforehand. The exact same process is used. If the process is more painful for others, when should the notifications begin? 14 days seems excessive to me. – Michael J. Apr 1 '16 at 12:57
0

In many cases, once the password expires, you cannot use the application at all until you reset the password. If you're in a hurry, you may not appreciate forced interruption to reset the password at inopportune time. A grace period allows you to continue using the application so you can schedule a more suitable time to reset the password.

If you used multiple devices and password manager that doesn't automatically sync between all your devices, then resetting password may involve having to copy over the new password to your other devices.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.