NIST proposes barring some of the most nonsensical password rules

https://arstechnica.com/security/2024/09/nist-proposes-barring-some-of-the-most-nonsensical-password-rules/

by ashton314 • 2 years ago

44 3 2 years ago

Glant• 2 years ago

Verifiers SHALL verify the entire submitted password (i.e., not truncate it).

That'd be a nice world to live in. I love making an account with a service just to not be able to log in because the password that the sign up form allowed is too long for the log in form.

cge• 2 years ago

This article appears mistaken about which parts of the guidelines are new.

The recommendation against periodic password change requirements, for example, has been part of NIST guidelines for years, in previous versions of this document. This has not kept a large number of US federal and state government agencies from requiring periodic password changes, sometimes even stating that it is a regulatory requirement. It's not clear that the NIST guidelines have any effect whatsoever on the very government NIST is part of.

spott• 2 years ago

The recommendation for periodic password change requirements is changing from SHOULD NOT to SHALL NOT, which hopefully will have an effect on things moving forward.

NIST proposes barring some of the most nonsensical password rules

Related Stories