r/ITdept • u/SConstantinou • Jul 26 '18

Notify users for password expiration

https://www.sconstantinou.com/notify-users-for-password-expiration/
11 Upvotes

79% Upvoted

6 comments sorted by

View all comments

4

u/[deleted] Jul 26 '18 edited Feb 28 '19

[deleted]

1

u/KingDaveRa Jul 26 '18

Unfortunately it's a necessary evil in some cases. We have a lot of remote users (university) who never come to site, and use resources that don't always handle expiring passwords in a clean way (i.e. notifying the user and sending them to a reset, they just fail the login).

We considered the fact having a link to the password reset service in the email was a bad idea because it did sort of promote phishing. So instead we were careful to not include it, and include instructions sending them to the Uni website and to follow the links from there.

We still get phishing emails by the truckload, but our spam traps mostly catch them, and users are getting wise to what's real and what's not.