SoylentNews

Latest NIST Guidelines on Password Policies

posted by martyb on Friday August 19 2016, @07:32PM   
from the keeping-things-to-yourself dept.

Bill Dimm writes:

The latest NIST (United States National Institute for Standards and Technology) guidelines on password policies recommend a minimum of 8 characters. Perhaps more interesting is what they recommend against. They recommend against allowing password hints, requiring the password to contain certain characters (like numeric digits or upper-case characters), using knowledge-based authentication (e.g., what is your mother's maiden name?), using SMS (Short Message Service) for two-factor authentication, or expiring passwords after some amount of time. They also provide recommendations on how password data should be stored.

[Ed. Note: Contrary to common practice, I would advocate reading the entire linked article so we can have an informed discussion on the many recommendations in the proposal. What has been your experience with password policies? Do the recommendations rectify problems you have seen? Is it reasonable to expect average users to follow the recommendations? What have they left out?]

---

Original Submission

• Re:"Weaken" (Score: 3, Insightful) by stormwyrm on Saturday August 20 2016, @03:00PM

  by stormwyrm (717) on Saturday August 20 2016, @03:00PM (#390578) Journal

  The point the GP was trying to make is that lengthening the password is far more effective than increasing the possible characters in the password. Which is why password length restrictions are extremely irksome. If you have an XKCD 936-style password with seven words, that would be 2048⁷, 1.51×10²³ possible passwords (77 bits of entropy). Note that a password generated according to that system uses all lowercase letters, it beats the shit out of your 12-character password entropy-wise (62¹² is only 3.22×10²¹ or 71 bits, so my password is two orders of magnitude stronger than yours), and above all, IT IS MUCH EASIER FOR HUMANS TO REMEMBER! Humans are the weak link here, so why the hell would you not exploit the natural ability of people to generate connections between random words (I do it by inventing stories) as opposed to forcing people into the sorts of memory games which are unnatural to human cognition? Do you really hate your users that much as you have said earlier? If you do, then they will hate you right back and undermine your user-unfriendly policy every chance they get. Security, to be effective, must also be usable.

  --
  Numquam ponenda est pluralitas sine necessitate.

  Parent

  Starting Score:	1		point
  Moderation		+1
  Insightful=1, Total=1
  Extra 'Insightful' Modifier		0
  Karma-Bonus Modifier		+1
  Total Score:		3