NIST proposes barring some of the most nonsensical password rules
NIST proposes barring some of the most nonsensical password rules
Proposed guidelines aim to inject badly needed common sense into password hygiene.
Here is the text of the NIST sp800-63b Digital Identity Guidelines.
![[Deleted]](https://sh.itjust.works/pictrs/image/8a31ebe7-7a5b-4d8f-9352-e4c1e056055d.jpeg?format=webp&thumbnail=196)
You're viewing a single thread.
i had to login for some functions at work. i believe the minimums were 8 characters, 1 caapitol, 1 number. and we all hated it, because the passwords had to be changed every 90 days, and you couldn't reuse passwords. eventually you are going to run out of things you can reasonably use that you could remember and then would be forced to use some sort of password manager. but OOPSIE you couldn't install any software on the office computer so you would have to resort to writing them down somewhere. it was a mess.
fortunately corporate decided to just change the entire system adopting most of these rules, min 15 characters, no special character, no hints, no forced changing passwords unless you think you have been compromised or just want to change it. we do have to use 2fa to access some things if you aren't sitting at the office computer but other than that people are much happier about passwords now.
Half the users passwords is going to be {Company}@{YEAR}
Don't forget classics like Fuck_this_shit1! Fuck_this_shit2!
Oh umm. I would never make my password this...
Deleted
I would always just create 1 password and append a number and it's special char, cycling from 1 to 0; like
1!,2@,3#. Never stayed at a place long enough to go higher than 7 or 8.I never gave a fuck about doing this because it's the companies fault for applying stupid policies. Whenever I've been allowed a password manager, they got real security instead of malicious compliance.
I feel like it's not a big impact on security if I use 2fa anyway. (Base password)(month)(year) is fine for me 😅
Ah, the downstream effects of compliance teams.
"Hurry we gotta check off all the boxes!!! What do these measures actually address? Don't know, don't care! Comply!"
Stockholm1 (capitol)
90 days later:
Stockholm2