3 ms·
From Appendix A of 800-63B: "Research has shown, however, that users respond in very predictable ways to the requirements imposed by composition rules." I'm n
by sbuttgereit 10y ago
From Appendix A of 800-63B:
"Research has shown, however, that users respond in very predictable ways to the requirements imposed by composition rules."
I'm not disputing this statement, but there is no reference to the supporting research either. I get that this isn't an academic paper, but I'd be curious to see the research they're referring to nonetheless. Does anyone here happen to know what they may have relied on for that claim?
- asperous 10y agohttp://www.guanotronic.com/~serge/papers/chi11b.pdf http://www.guanotronic.com/~serge/papers/chi11b.pdf
- sbuttgereit 10y agoVery cool, many thanks!
- hannob 10y agoThe FTC has looked a bit into the evidence of password policies: https://www.ftc.gov/news-events/blogs/techftc/2016/03/time-rethink-mandatory-password-changes https://www.ftc.gov/news-events/blogs/techftc/2016/03/time-r... However all that research is incredibly weak (like so much of infosec research). It's mostly based on observational data, so the usual caveat "correlation!=causation" applies.