This password bombshell will make you scratch your head...
-
OK, this is a headscratcher. This is why we were surprised. I found it in a Wall Street Journal article (paywall).
Bill Burr, the author of “NIST Special Publication 800-63. Appendix A.” which covers “traditional” password complexity requirements, has said that password complexity has failed in practice.
Whoa Nellie.
NIST started from scratch and the general idea of the new NIST guidelines is to use pass phrases of (suggested 25 normal characters) that change only as needed, as in a compromised account.
Turns out this NIST special publication has been formal since last month – and it’s been available in draft form for some time before that.
It is true that complex passwords with arbitrary password expiration force many users to make poor security choices. I applaud NIST for being pragmatic about this. Let’s at least get the conversation going. The real test will be how the audit and compliance world accepts these recommendations.
So now, we need a little bit of feedback about the password policy in your organization, because we were just updating our password training module!
Please take this 1-minute, 7-question, multiple choice survey.
Help me out and give me your feedback? This is the link to Survey Monkey (not phishing, but if you do not want to click on redirected links, please copy and paste this in your browser)
https://www.surveymonkey.com/r/KB4_password_survey
Thanks in advance!
Warm regards,
Stu
-
What is the goal of the survey?
The questions basically only ask what you're current password requirements are, and if you agree with the new NIST recommendations.
-
@dashrender We want to make sure our brand new password management training module reflects the requirements of the market. The survey tells us what you really need and want. Stu
-
What I want and what I can have are two entirely different things.
For example, I want SQRL (https://www.grc.com/sqrl/sqrl.htm) no passwords other than the one to unlock the SQRL client. But it's not out for general use yet.
I'd like websites, applications to allow unlimited or near unlimited password length because my password manager doesn't really care how long a password is, of course only this because I don't have SQRL today.
-
