4 ms·
"The National Institute of Standards and Technology (NIST) is no longer recommending people periodically change their passwords as part of the organization’s ne
by lholden 9y ago
"The National Institute of Standards and Technology (NIST) is no longer recommending people periodically change their passwords as part of the organization’s new draft of its Digital Identity Guidelines."
Untrue, misleading, and possibly harmful.
NIST isn't recommending USERS stop changing their passwords. That would be insane. They are recommending that services stop enforcing periodic password changes on users because it ends up hurting the user in the long run. (Ie, passwords should be easy for users and hard for attackers).
- ScottBurson 9y agoI think the keyword is "periodically". They're not saying not to change passwords for any reason; they're just saying not to do it solely because the password has been in use for some fixed amount of time. That recommendation applies to users as well as to services setting password policy.
- devonkim 9y agoYeah, I think the title could be better stated as "NIST Advises Against Mandatory Password Rotation Policies."