Proposed guidelines aim to inject badly needed common sense into password hygiene.
  • linearchaos@lemmy.worldEnglish
    38·
    24 hours ago

    The latest NIST guidelines now state that:

    Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords and
Verifiers and CSPs SHALL NOT require users to change passwords periodically. However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.
    • halcyoncmdr@lemmy.worldEnglish
      10·
      22 hours ago

      Makes sense. Most compromises aren’t brute force attacks. Allow all the characters and any brute force that is attempted will have to assume they’re part of it.

      Removing required periodical changes means people are less likely to use the same password and just increment a number added to the end. A compromised password with a setup like that is still compromised, they can make an educated guess as to what the new number is based on when was compromised compared to now.

    • UID_Zero@infosec.pubEnglish
      71·
      22 hours ago

      Please don’t take those recommendations out of context.

      They also recommend MFA, but people only ever bring up the “no rotation” bit.