9 ms·
Digital Identity Guidelines: Public Comment Period
- sbuttgereit 10y agoFrom Appendix A of 800-63B: "Research has shown, however, that users respond in very predictable ways to the requirements imposed by composition rules." I'm not disputing this statement, but there is no reference to the supporting research either. I get that this isn't an academic paper, but I'd be curious to see the research they're referring to nonetheless. Does anyone here happen to know what they may have relied on for that claim?
- asperous 10y agohttp://www.guanotronic.com/~serge/papers/chi11b.pdf http://www.guanotronic.com/~serge/papers/chi11b.pdf
- sbuttgereit 10y agoVery cool, many thanks!
- hannob 10y agoThe FTC has looked a bit into the evidence of password policies: https://www.ftc.gov/news-events/blogs/techftc/2016/03/time-rethink-mandatory-password-changes https://www.ftc.gov/news-events/blogs/techftc/2016/03/time-r... However all that research is incredibly weak (like so much of infosec research). It's mostly based on observational data, so the usual caveat "correlation!=causation" applies.
- jarboot 10y agoAs correctly captured by Peter Steiner in The New Yorker, “On the internet, nobody knows you’re a dog.” Interesting to see a cartoon cited in a government publication.
- DenisM 10y agoYou will be most pleased to know that the CIA made a reference to a Woodie Allen movie making mockery of the CIA. I can hardly wait till Woody Allen makes a reference to that publication in one of his upcoming movies. https://www.cia.gov/library/center-for-the-study-of-intelligence/csi-publications/csi-studies/studies/vol.-55-no.-4/driving-the-yanquis-bananas-the-feeling-was-mutual.html https://www.cia.gov/library/center-for-the-study-of-intellig...
- retox 10y agoMy banks online password requirements match the suggestions in these documents, but the passwords are entirely case insensitive. So its the same if I type "password" or "PaSSwOrD". There is a second passphrase that youre asked to select randomly chosen characters from combo boxes for, but that is case insensitive also. I got into an argument with their customer rep on Twitter about this not being the best case and they replied that it was based on industry best practice. I've never heard that before...
- will_hughes 10y agoCustomer Reps of any kind almost certainly have no idea about security. At best they'll ask their manager/helpdesk, who'll say "Just reply that it's based on industry standards" or something like that.
- Freak_NL 10y agoCustomer service at banks tend to reply "for safety reasons" to any question you pose about their antiquated password limitations. A password limit of 20 characters? That's for safety reasons. Which safety reasons? We can't tell you, because of safety reasons.
- mfukar 10y agoJust so I know what bank(s) to avoid, which one is (or are) this?
- Freak_NL 10y agoING in the Netherlands. Although to be fair, most banks have outrageously backwards password rules, and most limit the maximum length to something like 20 characters.
- will_hughes 10y agotl;dr: All of them. Try it, ask your bank why they impose a limit of N characters for their passwords (I bet N is < 30 characters). You'll almost certainly get a response along the lines of "We follow industry best practice" or something.
- kondro 10y agoCan someone suggest a federated protocol for password changing so my password manager can rotate passwords on my behalf in breaches and just every month or so?
- adyus 10y agoIt's all manual. Take a look at what Dashlane is doing (essentially writing a plugin for each site).
- raverbashing 10y agoAh the old "let's bother the user with BS password rules so we can store them in plaintext or md5'd on our DB"
- Elepsis 10y agoI wrote two blog posts on this idea a few years ago, but alas no credible player has pursued documenting a standard protocol for this. Password managers are, probably pragmatically, writing custom scrapers for major sites instead.
- laslfasjflsal 10y agoAbout Passwords - https://sites.google.com/site/magyarinformatikus/about-passwords https://sites.google.com/site/magyarinformatikus/about-passw...
- known 10y agoCheck https://www.random.org/passwords/ https://www.random.org/passwords/