I'm moving all my important stuff to physical FIDO2 capable Security Keys and also my OTPs, while I was doing this I updated a bunch of old passwords across multiple services and websites and I noticed something interesting (I believe is dump but what do I know); some of these services (big companies like EPIC Games) ask you for the new password only once; there is no re-type your new password option, if someone knows the reasoning behind such a brilliant idea (sarcasm) please share.

In my case i have seen sites that ask for email confirmation instead of the password, and I think that the idea is that as log you introduce your email right you can always reset your password, so no need to confirm the password.

@Jorge Salas That is also a little big flawed if you ask me. If your email is compromised then the attacker would have access to all those services without even knowing any of those services passwords.

but that is how internet has been build, your email has been the way to reset your password since the beginning and now emails accounts ask you for a secondary email so you can access the password reset flow, that is way 2FA is so important and netsuite ask us to reset our F* password every 30 days 😡

@Jorge Salas I'm assuming you're aware that you can change that in Setup > Company > General Preferences > Password Expiration in Days

@James Morris yeah, unfortunately for me, there is an IT department and I need to stick to their policies, but no worries, there is nothing than a post it under my keyboard can not solve 🤪

Ask IT why they're not following best practice and point them to the NIST standards that no longer recommend frequent password rotation, except in case of a breach. 😂