4 ms·
If I recally correctly, NIST recently issued guidelines specifically against password expiration/recycling and against forced limits on what characters you can
by ue_ 10y ago
If I recally correctly, NIST recently issued guidelines specifically against password expiration/recycling and against forced limits on what characters you can have in your password.
- khrakhen 10y agoYep. All the more infuriating. They know better. NGOs, private industry and the US government at most levels there has been a movement away from password length limits and password expiration and SMS as a second factor. (Even OTP and hashes may be replaced by U2F keys someday.) Then we get this recommendation for password expirations. Two steps forward, one back -- as always.
- willstrafach 10y agoWhat? The old suggestion which government/enterprise followed was quarterly password changes/rotation. This is no longer recommended by NIST though. How is that bad?