• linearchaos@lemmy.world
    link
    fedilink
    English
    arrow-up
    39
    ·
    2 months ago

    The latest NIST guidelines now state that:

    Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords and
    Verifiers and CSPs SHALL NOT require users to change passwords periodically. However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.
    
    • halcyoncmdr@lemmy.world
      link
      fedilink
      English
      arrow-up
      12
      ·
      2 months ago

      Makes sense. Most compromises aren’t brute force attacks. Allow all the characters and any brute force that is attempted will have to assume they’re part of it.

      Removing required periodical changes means people are less likely to use the same password and just increment a number added to the end. A compromised password with a setup like that is still compromised, they can make an educated guess as to what the new number is based on when was compromised compared to now.

    • UID_Zero
      link
      fedilink
      English
      arrow-up
      8
      arrow-down
      1
      ·
      2 months ago

      Please don’t take those recommendations out of context.

      They also recommend MFA, but people only ever bring up the “no rotation” bit.