Voicing my concerns here as well: the complexity requirements is both arbitrary and inadequate! Maximum 10 characters but has to have every kind of characters, have to change every once in while…
I want to set a password (in correct battery staple horse style) for an actual secure Secure Boot set up, but this is keeping me away from it completely. Even if I could set such a password, the fact that I have to change it to something else in 3 weeks is insane.
I hope this gets fixed with a BIOS update, was very disappointed.
Framework 13 Laptop AMD based, just wanted to remove my set bios password the other day. When i first managed to enter the settings area by providing this already set bios password, it immediately showed that this very password apparently expired and that I needed to provide a new one. I have never seen this kind of dialog box before ever and wasnt even aware that the bios password could expire at all or that there were expiry settings somewhere (where exactly?).
in this immediate password change enforcing dialog, i could not at all in no way like remove the password as a remedy, provide empty/no password as the new setting. So i needed to first provide an intermediary password temporarily first, and then go into the uefi bios security settings and re-set the admin password once more any only there I could leave the new password empty, thus removing my password for uefi bios all together completely.
any ideas on this matter? very odd to me. also this 10character limit max etc (other thread).
thank you.
as I have never seen this expiry before, round about when after what time spans? or login attempts, counters? does an admin password expire? any ideas? thank you.
Maybe after 1 or 2 months? I’m not really sure. I received my FW13 AMD in October and it has made me change it last month when I went into bios.
I then went into bios some time later and forgot what I changed it to. After I dealt with that anger, I found the mainboard reset procedure and cleared the password and just left it disabled now.
Umm. Something very similar happened to me after my Framework ran out of battery; some BIOS settings have reset, including the RTC (date and time), and the password was suddenly expired.
However, it seems that ordinarily, the period after which the password expires is 1 month (probably something like 30 days).
Furthermore, as I’ve had to change the BIOS password three (3) times now, the BIOS does seem to remember at least the last three (3) passwords, since I could not use any of the previous passwords. Funnily enough, that was even after the BIOS settings have reset.
Suffice to say, I hate this so much, and the policy requirements combined with the absurd length limit are just wrong. I will confess here that I would absolutely not remember a brand new password each month.
@Matt_Hartley
I don’t understand how this is not a support topic - could you elaborate?
Is it because of the phrasing of the original post?
(Edit: Thanks in advance! I don’t mean to complain, it’s an honest question because I think this may have simply been a mistake).
I would think that a considerable amount of community members raising concerns about the obvious shortcomings of the current BIOS security implementation would make for a high priority support case.
So far, I’ve seen statements about the
Non-compliance with NIST password security guidelines (length, expiry, complexity rules)
Storage of a password (hash?) history of at least 3-10 passwords that survives a BIOS reset
2a. Suggestion that the password history may be stored in plain text because a character limit is usually a sign of unhashed, plaintext passwords in storage.
Refusal to deploy Framework Laptops inside a business environment (that should be a biggie!) due to the unbearable restraints for IT support that needs to handle BIOS passwords
Community members having to reset their BIOS due to a forgotten password that could not be memorized because the ruleset won’t allow for a secure AND memorizable password, let alone passphrase. And no support article on how to handle that situation.
Community members actually opening support tickets that were escalated to the top of the customer support hierarchy - to figure out if there is a way to disable the password expiry.
Surely a ‘support topic’ is a single request for help with an issue with a purchase.
This is the first time I have heard of such a rule. But sure, my single request, listed above, is “to allow disabling all of the password enforcement as a whole”.
This is more a query about how the password in the BIOS is implemented and hence a general query.
Nope. This is the community venting and voicing their dissatisfaction with the Framework personnel pretending there is no problem with the BIOS behavior. They moved the support topic to the general discussion and pretended there was no defect when I opened a support ticket over the email as I was not satisfied with the product malfunction.
Of course any purchaser can contact support officially if they have a problem, as no doubt has happened on this issue.
Indeed it did. And the Framework answer was akin to “pound sand”.
I have always been leary of bios passwords. But I was considering it because the FL16 will be a big purchase for me and I plan on doing a lot of traveling for the next several years.
This situation is really concerning, not so much that it exists, but that It seemingly has not been actively addressed by Framework…
@ksimuk@CruelSun Both of you are asking the wrong fella. He’s Linux support, not firmware or BIOS/UEFI stuff. @Kieran_Levin is the guy you want. Or potentially @TheTwistgibber since he’s customer support generally. All Matt can do is ask the guys in charge of this stuff and ferry the response back here.
