3 ms·

It got like this because a premature spec became a government department standard and then a widely used government convention and finally an ISO standard. The

It got like this because a premature spec became a government department standard and then a widely used government convention and finally an ISO standard. The guy who wrote the standard these stupid conventions are based upon considers it a complete mistake. Part of the reason this really bad idea was acceptable at the time is because many government software systems were old and had limitations on storing large passwords (yes, some systems store literal passwords instead of an equivalent hash). A better alternative is a natural language sentence containing a minimum of 64 characters and no sequence of identical characters greater than 2 that is hashed to a 256 character hash. The military solution to get away from that stupidity is use of CAC, which rolled out about 15 years ago, and is now universal across the military. EDIT: It is a NIST standard and not an ISO standard * https://www.cleartechgroup.com/why-do-passwords-have-to-be-so-complicated/ https://www.cleartechgroup.com/why-do-passwords-have-to-be-s...

jaclaz 8y ago
No. It is NOT really-really a NIST "standard", as a matter of fact the mentioned NIST documents linked to in the article make a completely different set of suggestions fron what the OP listed: https://pages.nist.gov/800-63-3/sp800-63b.html https://pages.nist.gov/800-63-3/sp800-63b.html and in any case they are guidelines that only apply to some government infrastructures and actually sport: >These guidelines provide technical requirements for federal agencies implementing digital identity services and are not intended to constrain the development or use of standards outside of this purpose. The relevant section is 5.1.1, apparently the NIST calls passwords "Memorized Secrets" Here is the older version (now superseded by the above): https://csrc.nist.gov/publications/detail/sp/800-63/2/archive/2013-08-29 https://csrc.nist.gov/publications/detail/sp/800-63/2/archiv... https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.S...
- larkeith 8y ago
  Of particular note: the current NIST standard actively recommends against every single one of the requirements listed in the OP, with the exception of username derivatives and previous passwords.
GordonS 8y ago
64 characters?! I use a 24-character phrase, and TBH it's a PITA to type. 64 characters sounds... painful. Disclaimer: I a password manager for most passwords, but there are a few I need to know, such as for my workstation and the password for the password manager itself.
- austincheney 8y ago
  Just use a regular sentence. Something easy to remember with common words. It is only painful if you follow stupid rules and self-impose the pain.
  - GordonS 8y ago
    I do use a regular sentence, and one that I can easily remember - I meant it's difficult to correctly type so many characters correctly when they're masked. My workstation also has a FDE system on it that will lock me out if I get it wrong 3 times in a day, so it's a bit stressful :)
  - tomjen3 8y ago
    No, it is a pain when you have to type it on anything but a computer.

jaclaz 8y ago

No. It is NOT really-really a NIST "standard", as a matter of fact the mentioned NIST documents linked to in the article make a completely different set of suggestions fron what the OP listed: https://pages.nist.gov/800-63-3/sp800-63b.html https://pages.nist.gov/800-63-3/sp800-63b.html and in any case they are guidelines that only apply to some government infrastructures and actually sport: >These guidelines provide technical requirements for federal agencies implementing digital identity services and are not intended to constrain the development or use of standards outside of this purpose. The relevant section is 5.1.1, apparently the NIST calls passwords "Memorized Secrets" Here is the older version (now superseded by the above): https://csrc.nist.gov/publications/detail/sp/800-63/2/archive/2013-08-29 https://csrc.nist.gov/publications/detail/sp/800-63/2/archiv... https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.S...

larkeith 8y ago
Of particular note: the current NIST standard actively recommends against every single one of the requirements listed in the OP, with the exception of username derivatives and previous passwords.

GordonS 8y ago

64 characters?! I use a 24-character phrase, and TBH it's a PITA to type. 64 characters sounds... painful. Disclaimer: I a password manager for most passwords, but there are a few I need to know, such as for my workstation and the password for the password manager itself.

austincheney 8y ago
Just use a regular sentence. Something easy to remember with common words. It is only painful if you follow stupid rules and self-impose the pain.
- GordonS 8y ago
  I do use a regular sentence, and one that I can easily remember - I meant it's difficult to correctly type so many characters correctly when they're masked. My workstation also has a FDE system on it that will lock me out if I get it wrong 3 times in a day, so it's a bit stressful :)
- tomjen3 8y ago
  No, it is a pain when you have to type it on anything but a computer.