Complexity rules for BIOS password? Why? (Moved)

Voicing my concerns here as well: the complexity requirements is both arbitrary and inadequate! Maximum 10 characters but has to have every kind of characters, have to change every once in while…
I want to set a password (in correct battery staple horse style) for an actual secure Secure Boot set up, but this is keeping me away from it completely. Even if I could set such a password, the fact that I have to change it to something else in 3 weeks is insane.

I hope this gets fixed with a BIOS update, was very disappointed.

4 Likes

What? BIOS password can expire now? what “interesting” time are we living in? I guess artificial obsolescence is normalized now.

1 Like

Framework 13 Laptop AMD based, just wanted to remove my set bios password the other day. When i first managed to enter the settings area by providing this already set bios password, it immediately showed that this very password apparently expired and that I needed to provide a new one. I have never seen this kind of dialog box before ever and wasnt even aware that the bios password could expire at all or that there were expiry settings somewhere (where exactly?).

in this immediate password change enforcing dialog, i could not at all in no way like remove the password as a remedy, provide empty/no password as the new setting. So i needed to first provide an intermediary password temporarily first, and then go into the uefi bios security settings and re-set the admin password once more any only there I could leave the new password empty, thus removing my password for uefi bios all together completely.

any ideas on this matter? very odd to me. also this 10character limit max etc (other thread).
thank you.

1 Like

Lots of info in this thread which you may have already seen.

TLDR; At this stage there appears to be no way to customise the expiry or complexity settings.

1 Like

as I have never seen this expiry before, round about when after what time spans? or login attempts, counters? does an admin password expire? any ideas? thank you.

1 Like

Maybe after 1 or 2 months? I’m not really sure. I received my FW13 AMD in October and it has made me change it last month when I went into bios.

I then went into bios some time later and forgot what I changed it to. After I dealt with that anger, I found the mainboard reset procedure and cleared the password and just left it disabled now.

2 Likes

The password expired in less than 12 hours.

Wouldn’t it be reasonable to provide a validity period of at least one month?

1 Like

Umm. Something very similar happened to me after my Framework ran out of battery; some BIOS settings have reset, including the RTC (date and time), and the password was suddenly expired.

However, it seems that ordinarily, the period after which the password expires is 1 month (probably something like 30 days).

Furthermore, as I’ve had to change the BIOS password three (3) times now, the BIOS does seem to remember at least the last three (3) passwords, since I could not use any of the previous passwords. Funnily enough, that was even after the BIOS settings have reset.

Suffice to say, I hate this so much, and the policy requirements combined with the absurd length limit are just wrong. I will confess here that I would absolutely not remember a brand new password each month.

7 Likes

we need transparency and clear documentation of these nasty features please. seriously. this is bad practice. thanks.

1 Like

Thanks for this and all the associated posts.

Thank f"&k I didn’t set a password.

I live in the woods and rarely go to town, and when I do the laptop is never more than a few feet away from me unless at my relatives.

Important data is encrypted so hopefully the worst I would get is a stolen laptop, not stolen data.

However if there is a lock on how many times you can try even 1000, manually not possible in a second,
and else demand new password after 10 attempts.

So is it such a big deal.

Clear BIOS by manual reset would seem a more likely worry, or am I missing something?

@Matt_Hartley
I don’t understand how this is not a support topic - could you elaborate?
Is it because of the phrasing of the original post?
(Edit: Thanks in advance! I don’t mean to complain, it’s an honest question because I think this may have simply been a mistake).

I’ve browsed the support section a bit and I can’t see the difference to a question like this one, for instance, which also mainly addresses BIOS settings/features: [RESPONDED] Linux Ryzen AI support on Framework AMD boards

I would think that a considerable amount of community members raising concerns about the obvious shortcomings of the current BIOS security implementation would make for a high priority support case.

So far, I’ve seen statements about the

  1. Non-compliance with NIST password security guidelines (length, expiry, complexity rules)
  2. Storage of a password (hash?) history of at least 3-10 passwords that survives a BIOS reset
    2a. Suggestion that the password history may be stored in plain text because a character limit is usually a sign of unhashed, plaintext passwords in storage.
  3. Refusal to deploy Framework Laptops inside a business environment (that should be a biggie!) due to the unbearable restraints for IT support that needs to handle BIOS passwords
  4. Community members having to reset their BIOS due to a forgotten password that could not be memorized because the ruleset won’t allow for a secure AND memorizable password, let alone passphrase. And no support article on how to handle that situation.
  5. Community members actually opening support tickets that were escalated to the top of the customer support hierarchy - to figure out if there is a way to disable the password expiry.
12 Likes

Surely a ‘support topic’ is a single request for help with an issue with a purchase.

This is more a query about how the password in the BIOS is implemented and hence a general query.

Of course any purchaser can contact support officially if they have a problem, as no doubt has happened on this issue.

Surely a ‘support topic’ is a single request for help with an issue with a purchase.

This is the first time I have heard of such a rule. But sure, my single request, listed above, is “to allow disabling all of the password enforcement as a whole”.

This is more a query about how the password in the BIOS is implemented and hence a general query.

Nope. This is the community venting and voicing their dissatisfaction with the Framework personnel pretending there is no problem with the BIOS behavior. They moved the support topic to the general discussion and pretended there was no defect when I opened a support ticket over the email as I was not satisfied with the product malfunction.

Of course any purchaser can contact support officially if they have a problem, as no doubt has happened on this issue.

Indeed it did. And the Framework answer was akin to “pound sand”.

5 Likes