NISTer here — We still have a password rotation policy, which I assume you are referring to in reference to [0]. I think they are working on it, but I’m not sur

NISTer here — We still have a password rotation policy, which I assume you are referring to in reference to [0]. I think they are working on it, but I’m not sure if we set our own password policy or if it’s something that needs to go through Commerce or GSA or similar. But in fairness to NIST all of their machines have been smartcard auth only for a while now. Internal services are still under a password rotation policy, but you need a smartcard to access any NIST computer, and smartcard or RSA token for remote access to the network. So in my opinion it could be a lot worse in terms of an actual security risk. (I am not a security researcher, just a random NIST scientist with personal opinions) [0]: https://pages.nist.gov/800-63-3/sp800-63b.html https://pages.nist.gov/800-63-3/sp800-63b.html