Open daviddavo opened 2 years ago
I made a branch for this since I'm interested in the same feature. A few thoughts:
In all technicality old passwords don't get less secure. In fact, NIST doesn't recommend rotating strong passwords anymore. If you want a certain account to "age" just set an expiration date for it. However, if you are using a long, complex password (15+ chars) then there is no sense in aging it out.
Summary
Even if you didn't put an expiration date on a password, it would be nice to include on the health check passwords that have not been changed in over 2 years (for example, perhaps this could be customized)
Examples
Weak password
Password has expired
Context
I have a lot of old passwords without an expiration date