Voicing my concerns here as well: the complexity requirements is both arbitrary and inadequate! Maximum 10 characters but has to have every kind of characters, have to change every once in while…
I want to set a password (in correct battery staple horse style) for an actual secure Secure Boot set up, but this is keeping me away from it completely. Even if I could set such a password, the fact that I have to change it to something else in 3 weeks is insane.
I hope this gets fixed with a BIOS update, was very disappointed.
Framework 13 Laptop AMD based, just wanted to remove my set bios password the other day. When i first managed to enter the settings area by providing this already set bios password, it immediately showed that this very password apparently expired and that I needed to provide a new one. I have never seen this kind of dialog box before ever and wasnt even aware that the bios password could expire at all or that there were expiry settings somewhere (where exactly?).
in this immediate password change enforcing dialog, i could not at all in no way like remove the password as a remedy, provide empty/no password as the new setting. So i needed to first provide an intermediary password temporarily first, and then go into the uefi bios security settings and re-set the admin password once more any only there I could leave the new password empty, thus removing my password for uefi bios all together completely.
any ideas on this matter? very odd to me. also this 10character limit max etc (other thread).
Umm. Something very similar happened to me after my Framework ran out of battery; some BIOS settings have reset, including the RTC (date and time), and the password was suddenly expired.
However, it seems that ordinarily, the period after which the password expires is 1 month (probably something like 30 days).
Furthermore, as I’ve had to change the BIOS password three (3) times now, the BIOS does seem to remember at least the last three (3) passwords, since I could not use any of the previous passwords. Funnily enough, that was even after the BIOS settings have reset.
Suffice to say, I hate this so much, and the policy requirements combined with the absurd length limit are just wrong. I will confess here that I would absolutely not remember a brand new password each month.
I don’t understand how this is not a support topic - could you elaborate?
Is it because of the phrasing of the original post?
(Edit: Thanks in advance! I don’t mean to complain, it’s an honest question because I think this may have simply been a mistake).
I would think that a considerable amount of community members raising concerns about the obvious shortcomings of the current BIOS security implementation would make for a high priority support case.
So far, I’ve seen statements about the
Non-compliance with NIST password security guidelines (length, expiry, complexity rules)
Storage of a password (hash?) history of at least 3-10 passwords that survives a BIOS reset
2a. Suggestion that the password history may be stored in plain text because a character limit is usually a sign of unhashed, plaintext passwords in storage.
Refusal to deploy Framework Laptops inside a business environment (that should be a biggie!) due to the unbearable restraints for IT support that needs to handle BIOS passwords
Community members having to reset their BIOS due to a forgotten password that could not be memorized because the ruleset won’t allow for a secure AND memorizable password, let alone passphrase. And no support article on how to handle that situation.
Community members actually opening support tickets that were escalated to the top of the customer support hierarchy - to figure out if there is a way to disable the password expiry.
Surely a ‘support topic’ is a single request for help with an issue with a purchase.
This is the first time I have heard of such a rule. But sure, my single request, listed above, is “to allow disabling all of the password enforcement as a whole”.
This is more a query about how the password in the BIOS is implemented and hence a general query.
Nope. This is the community venting and voicing their dissatisfaction with the Framework personnel pretending there is no problem with the BIOS behavior. They moved the support topic to the general discussion and pretended there was no defect when I opened a support ticket over the email as I was not satisfied with the product malfunction.
Of course any purchaser can contact support officially if they have a problem, as no doubt has happened on this issue.
Indeed it did. And the Framework answer was akin to “pound sand”.