4 ms·
Something else for IT people to ignore and then pikachu face when they get crypto locked because their 90 day password rotations didn't work.
by overstay8930 3y ago
Something else for IT people to ignore and then pikachu face when they get crypto locked because their 90 day password rotations didn't work.
- aeonik 3y agoIt's actually a REALLY great resource. I highly recommend anyone to at least skim it. They do a wonderful job breaking down the entire industry into easily understood pieces and connect everything together. I consider it essential reading for anyone getting into the industry.
- overstay8930 3y agoI agree, it's just that most IT departments blatantly ignore most recommendations because they just don't care.
- hsdropout 3y agoNot sure if I'm missing your intentional irony, but NIST was one of the best places to send folks who think user password rotations are a good idea. I said "was" because pretty much everyone has now caught up, but NIST updated guidance shortly after big breaches were able to be studied. > Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets. Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63b.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.S...
- jjminer 3y agoPresumably intentional, or at least I had similar sarcastic thoughts. I listen to supposed experts all the time attempting to explain how their anecdotal and imaginary (or uninformed, to be generous, because they didn't actually read and comprehend it) scenarios explain how 800-63-3 (and soon to be 800-63-4) clearly isn't correct.