Re: Password expiration Process ?

[Scott Bradner <sob () HARVARD EDU>]

>  First, are any of you using a password
> expiration process in a student self-service environment?

specifically no
reviewing the research (as was done in a discussion on this list a
while back) we concluded that forcing pasword changes would, in net,
reduce security rather than increase it for this type of situation
(along with pissing off the students etc)

it seems far better to do things like send email notices when some
kinds of changes are made by the student (e.g. changing password or
privacy settings) that might indicate a 3rd party accessing the
account

Scott