New NIST password guidelines: don't require character types or rotation

Re:New NIST password guidelines: don't require character typ... by mulmen on Wednesday December 14, 2016 @12:33AM (#13174092)

Can you explain those numbers? 7-12% of what? Are you suggesting that rate limiting reduces call volumes by a little more than half compared to lockouts? Where did you get the data?

[ Parent | on HN ]

Re:New NIST password guidelines: don't require character typ... by Spooky23 on Wednesday December 14, 2016 @07:37AM (#13175504)

In one large, diverse environment I'm familiar with, that policy spiked the need for intervention (password resets, unlocks, etc).

That spikes costs. Many users (mobile) need to call someone, which is $$$.

Those interventions also lead to things like figuring out what app stored password is relocking the account. That kind of exercise could cost a few hundred bucks.

...all for zero benefit.

[ Parent | on HN ]

Re:New NIST password guidelines: don't require character typ... by ajkjk on Wednesday December 14, 2016 @01:46AM (#13174308)

I think s/he's saying that rate limiting leads to fewer password resets compared to lockouts. Which makes sense.

[ Parent | on HN ]