Exactly. And even a bit of common sense and engineering mindset (technical thinking) gets you far.
Engineering mindsets commonly overestimate their abilities and knowledge, misled by apparent “rationality.” Most prominently outside their area of expertise, but not only. So I call this a poor argument.
For example: I'm not a security expert at all and never have been security professional. Yet it was always obvious to me that password changing rules are counterproductive,
Moving away from the practice is rooted in things one shouldn’t know before late 2010s or without having access to a vast body of statistical data. At the same time, obsoleting password cycling isn’t denying validity of the past argument. This is different from the “must contain $foo” policies, which were recognized as a reasoning mistake. So how was it obvious?
as are strict "include 1 number, 1 special character and 1 big letter" rules.
Which stands in opposition to the “engineering mindset” and “common sense” claim. It weren’t laypeople, who promoted it. It weren’t complete ignorants repeating “good advice,” who formed the principal force behind its use. It were people, who had “engineering mindset,” and who had knowledge ranging from basic to expert level. And the final, crucial ingredient was following “common sense,” instead of doing a cold, rational check of one’s own thinking process.
The problem is, the claim is valid. Not only it is valid, but it is
sound. There is no error in logic. It is maths schoolchildren can do, and correctly come to the same conclusion, so “even an idiot” can see it’s right. Where is the catch? The original, perfectly good statement is declarative in its nature. But who would care about such subtle details, except perhaps some silly pedants? At some point it was taken as a normative statement. This is where things went south. This silently changed the premises, but only a few were careful enough to notice. I wasn’t among them.
The problem was further amplified on the recipient side. Blame the phenomenon, that may be summed up as “better therefore desired.” A thing which, again, “engineering mindsets” seem to me vulnerable to more than anybody else. It gives us the feel of “rationality” we so much appreciate.
"Best practice" lists are good food for thought, like "these could be good ideas", but critical thinking should be still applied. Security is not entirely rocket science, one can actually logically think about threat models and even calculate probabilities - which is all basic high school math.
I would say: depends on who makes the list. Is it just a random list on the internet? Probably not good even as “brainfood”: many are made to attract clicks, blindly copied from whatever the content creator could scavenge. To the point of being self-contradicting or off-topic. Things are different, when it comes from a well-curated source or from somebody with some authority, repeats what others in the field say. This kind of advice is well founded. Everything may be challenged and history teaches us it should. But one should have a sane dose of respect towards the opponent. Otherwise, though history shows clemency and forgets most of such attempts, one makes a fool of oneself.
Home
Help
Search
Login
Register
