Proposed guidelines aim to inject badly needed common sense into password hygiene.
  • @linearchaosEnglish
    39•3 months ago

    The latest NIST guidelines now state that:

    Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords and
Verifiers and CSPs SHALL NOT require users to change passwords periodically. However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.
    • @halcyoncmdrEnglish
      12•3 months ago

      Makes sense. Most compromises aren’t brute force attacks. Allow all the characters and any brute force that is attempted will have to assume they’re part of it.

      Removing required periodical changes means people are less likely to use the same password and just increment a number added to the end. A compromised password with a setup like that is still compromised, they can make an educated guess as to what the new number is based on when was compromised compared to now.

    • @[email protected]English
      7•3 months ago

      Please don’t take those recommendations out of context.

      They also recommend MFA, but people only ever bring up the “no rotation” bit.

      • @linearchaosEnglish
        4•3 months ago

        Emphasis was from the article, not mine.

        They also recommend not using knowledge based prompts, allowing at least 64: characters,

  • @AstridWipenaughEnglish
    18•3 months ago

    This is the most excited I’ve been about a NIST standard in a good while

  • P03 LockeEnglish
    3•3 months ago

    NIST SP 800-63b already did that several years ago. People just need to follow it.