3 ms·

What else is new? I can't find a source right now, but IIRC NIST doesn't even follow their own password guidelines. This seems like a relatively minor flub in c

What else is new? I can't find a source right now, but IIRC NIST doesn't even follow their own password guidelines. This seems like a relatively minor flub in comparison. If the verbiage was tweaked a bit to say something like "the https ensures that you're actually connected to the website whose name shows up in your address bar" I think there'd be nothing to complain about.

blakesterz 7y ago
To be fair to them, how the hell do you possibly explain what that means to people who don't know or care how any of these things work? How do you explain TLS and DNS and HTTP and web servers and all this stuff in less than an hour in a way that makes any sense to someone that doesn't care about technology and just wants this stuff to work?
- rtisdale 7y ago
  You're in a perfectly soundproof room with one other person. Whatever you talk about with this person can't be heard by anyone outside the room. This room can only help guarantee that no one outside can hear you, not that the person you're talking to is trustworthy. If the other person is a thief and you tell them where your valuables are, they could be stolen. If the other person is trustworthy, you can be sure no one else will hear what you tell them and your secrets are safe. The soundproof room is HTTPS. The other person is a server. You could tell someone something like this and provide a lay person with a basic understanding of many fundamental building blocks of the web rather quickly (DNS can be explained as a phone book for example).
rsfern 7y ago
NISTer here — We still have a password rotation policy, which I assume you are referring to in reference to [0]. I think they are working on it, but I’m not sure if we set our own password policy or if it’s something that needs to go through Commerce or GSA or similar. But in fairness to NIST all of their machines have been smartcard auth only for a while now. Internal services are still under a password rotation policy, but you need a smartcard to access any NIST computer, and smartcard or RSA token for remote access to the network. So in my opinion it could be a lot worse in terms of an actual security risk. (I am not a security researcher, just a random NIST scientist with personal opinions) [0]: https://pages.nist.gov/800-63-3/sp800-63b.html https://pages.nist.gov/800-63-3/sp800-63b.html

blakesterz 7y ago

To be fair to them, how the hell do you possibly explain what that means to people who don't know or care how any of these things work? How do you explain TLS and DNS and HTTP and web servers and all this stuff in less than an hour in a way that makes any sense to someone that doesn't care about technology and just wants this stuff to work?

rtisdale 7y ago
You're in a perfectly soundproof room with one other person. Whatever you talk about with this person can't be heard by anyone outside the room. This room can only help guarantee that no one outside can hear you, not that the person you're talking to is trustworthy. If the other person is a thief and you tell them where your valuables are, they could be stolen. If the other person is trustworthy, you can be sure no one else will hear what you tell them and your secrets are safe. The soundproof room is HTTPS. The other person is a server. You could tell someone something like this and provide a lay person with a basic understanding of many fundamental building blocks of the web rather quickly (DNS can be explained as a phone book for example).

rsfern 7y ago

NISTer here — We still have a password rotation policy, which I assume you are referring to in reference to [0]. I think they are working on it, but I’m not sure if we set our own password policy or if it’s something that needs to go through Commerce or GSA or similar. But in fairness to NIST all of their machines have been smartcard auth only for a while now. Internal services are still under a password rotation policy, but you need a smartcard to access any NIST computer, and smartcard or RSA token for remote access to the network. So in my opinion it could be a lot worse in terms of an actual security risk. (I am not a security researcher, just a random NIST scientist with personal opinions) [0]: https://pages.nist.gov/800-63-3/sp800-63b.html https://pages.nist.gov/800-63-3/sp800-63b.html