<story><title>NIST to forbid requirement of specific passwords character composition</title><url>https://mastodon.social/@LukaszOlejnik/113193089731407165</url></story><parent_chain><item><author>cheriot</author><text>&amp;gt; SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically)&lt;p&gt;Are there employers that follow this advice? Mine won&amp;#x27;t (and won&amp;#x27;t say why).</text></item><item><author>hsdropout</author><text>This has been in their guidance since at least 2017.&lt;p&gt;&amp;quot;Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets. Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator&amp;quot;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;nvlpubs.nist.gov&amp;#x2F;nistpubs&amp;#x2F;SpecialPublications&amp;#x2F;NIST.SP.800-63b.pdf&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;nvlpubs.nist.gov&amp;#x2F;nistpubs&amp;#x2F;SpecialPublications&amp;#x2F;NIST.S...&lt;/a&gt;&lt;p&gt;Also worth pointing out that NIST doesn&amp;#x27;t set policy, so unfortunately this doesn&amp;#x27;t directly &amp;quot;forbid&amp;quot; anything, though many other policies reference 800-63.</text></item></parent_chain><comment><author>tialaramex</author><text>The only employer I&amp;#x27;ve had which had a dumb rotation rule was of course a huge American Credit Reference Agency which due to ordinary incompetence lost a lot of people&amp;#x27;s personal information.&lt;p&gt;These days I work in tertiary education, so there&amp;#x27;s a complete spectrum from people who probably have memorised a unique sixteen alphanumerics password twenty years ago to folks who needed a service desk worker to help them walk through resetting after having forgotten their password was the name of one of Henry VIII&amp;#x27;s wives. And there&amp;#x27;s likewise a spectrum between &amp;quot;I hand-built this optical splitter and splice so that I could steal the exam answers without any trace on the network&amp;quot; and &amp;quot;I wrote the formulae on my thigh in permanent marker and then wore a skirt with a big slit down one side&amp;quot; in terms of the technical sophistication of attacks.&lt;p&gt;Edited to add: When I did work for the CRA with the rotation rule I would write down each of the passwords in columns in the back of my log book since otherwise I might forget one and that was a huge pain to get reset, it&amp;#x27;s just not realistic to memorize &amp;quot;random&amp;quot; values you&amp;#x27;ll have to replace frequently. And of course they had two &amp;quot;Single&amp;quot; Sign On systems because of warring management, so that&amp;#x27;s &lt;i&gt;two&lt;/i&gt; passwords to rotate.</text></comment>
<story><title>NIST to forbid requirement of specific passwords character composition</title><url>https://mastodon.social/@LukaszOlejnik/113193089731407165</url></story><parent_chain><item><author>cheriot</author><text>&amp;gt; SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically)&lt;p&gt;Are there employers that follow this advice? Mine won&amp;#x27;t (and won&amp;#x27;t say why).</text></item><item><author>hsdropout</author><text>This has been in their guidance since at least 2017.&lt;p&gt;&amp;quot;Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets. Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator&amp;quot;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;nvlpubs.nist.gov&amp;#x2F;nistpubs&amp;#x2F;SpecialPublications&amp;#x2F;NIST.SP.800-63b.pdf&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;nvlpubs.nist.gov&amp;#x2F;nistpubs&amp;#x2F;SpecialPublications&amp;#x2F;NIST.S...&lt;/a&gt;&lt;p&gt;Also worth pointing out that NIST doesn&amp;#x27;t set policy, so unfortunately this doesn&amp;#x27;t directly &amp;quot;forbid&amp;quot; anything, though many other policies reference 800-63.</text></item></parent_chain><comment><author>ratherbefuddled</author><text>I&amp;#x27;ve found it commonplace these days at least in europe that organisations use SSO via an identity provider that requires MFA for everything they can - even clients who are banks and utilities that usually move at a glacial pace.&lt;p&gt;The last time I worked anywhere with periodic password change was 8 years ago and they were phasing it out.  The same place would reset your password to Monday123 if you got locked out (whether you needed a password reset or not) and forget to set the &amp;quot;force change&amp;quot; flag.</text></comment>