In July 2012, UITS Identity Management Systems team estimated that there were about 160,000 computing accounts at IU with “stale credentials.” Stale credentials mean a passphrase or password that is at least two years old. When I tried to visualize 160,000 stale credentials, all I could picture was a big pile of moldy bread. Obviously, I needed some help understanding that figure. So, I exercised my Google-fu and found some interesting facts:
• $160,000 recently bought a piece of controversial DC Comics memorabilia
• The oldest human fossils found we know of are about 160,000 years old
• An annual salary of $160,000 works out to about $80/hour
I’m a Bloomington townie, so the statistic that really brought it home for me was the 2010 census population in Bloomington of about 80,000 people. So, the number of IU accounts with stale credentials was about twice the population of Bloomington. That’s a huge pile! And some of that bread is *really* moldy…
At IU, passphrases were introduced in October of 2006 (see Passwords and passphrases for details). After six years and several awareness campaigns (requesting users to voluntarily update), there were still approximately 81,761 IU accounts that had not been changed. Faced with the growing pile of evidence, UITS recognized that folks at IU apparently needed stronger incentive to clean up that pile and announced that passphrases older than 2 years would start to expire during the fall, 2012 semester. In order to prevent a massive lockout event, passphrases will initially expire in batches of a few hundred each week, starting with the oldest credentials first. So, what does this mean for you? (more…)