2 ms·
NIST agrees, as if their update a few years ago. > Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, veri
by zmgsabst 4y ago
NIST agrees, as if their update a few years ago.
> Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.
https://pages.nist.gov/800-63-3/sp800-63b.html#memsecret https://pages.nist.gov/800-63-3/sp800-63b.html#memsecret
- acdha 4y agoThis is a really useful thing to keep in mind because even if you aren't directly bound by a requirement to follow the NIST standards, being able to point your policy people at that is handy if you can shift the conversation to “bring our policy in line with NIST” where there's a question about whether they'll later look bad for _not_ having done so. Typically these conversations are driven by risk aversion and things like federal standards help balance that perspective.
- selykg 4y agoThanks for the direct link, putting this in my back pocket when the discussion inevitably takes place.