this post was submitted on 26 Sep 2024
549 points (99.6% liked)

Technology

60113 readers
2539 users here now

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 2 years ago
MODERATORS
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
549
NIST proposes barring some of the most nonsensical password rules (arstechnica.com)
submitted 3 months ago by [email protected] to c/[email protected]
152 comments fedilink hide all child comments
 

Here is the text of the NIST sp800-63b Digital Identity Guidelines.

you are viewing a single comment's thread
view the rest of the comments
[โ€“] [email protected] 2 points 3 months ago* (last edited 3 months ago) (1 children)

The entity knows people will follow what they say for minimums. There's already someone in the comment section saying they're now fighting what these lax rules allow.

Edit: stupid product managers will jump at anything that makes it easier for their users and dropping it to 8, no special characters, and no resets is the new thing now.

[โ€“] [email protected] 1 points 3 months ago

What you're proposing is effectively the same as "they should publish inaccurate guidelines that do not actually represent their informed views on the matter, misleading everybody, to pretend that they can prevent the stupid from being stupid." It defeats the very reason why guidelines exist - to guide you towards the optimal approach in a given situation.

And sometimes the optimal approach is not a bigger min length. Convenience and possible vectors of attack play a huge role; if

  • due to some input specificity, typing out the password is cumbersome, and
  • there's no reasonable way to set up a password manager in that device, and
  • your blocklist of compromised passwords is fairly solid, and
  • you're reasonably sure that offline attacks won't work against you, then

min 8 chars is probably better. Even if that shitty manager, too dumb to understand that he shouldn't contradict the "SHOULD [NOT]" points without a good reason to do so, screws it up. (He's likely also violating the "SHALL [NOT]" points, since he used the printed copy of the guidelines as toilet paper.)