New NIST password guidelines: don't require character types or rotation

Re:New NIST password guidelines: don't require character typ... by tajen on Wednesday December 14, 2016 @03:27AM (#13174599)

Tip: Some systems only remember your last 3 or 10 passwords, so it's worth rotating up to Password9 and then coming back to Password0. Tip given by my boss who received it by his chain of command of old people who couldn't remember the password change. True story.

[ Parent | on HN ]

Re:New NIST password guidelines: don't require character typ... by Ntrails on Wednesday December 14, 2016 @04:19AM (#13174754)

I'm not sure that it makes much difference whether I reset to 0 or keep going through 10 and up. My biggest frustration is that every password change I'll mistype my closing digit for about a week before muscle memory gets the new one right,

(Although this time I had a unique experience where I adjusted quite quickly from "2" to "3" and because I was still thinking "don't forget to incrememnt" ended up typing "4". Uggggghhhhhhhhhh)

[ Parent | on HN ]

Re:New NIST password guidelines: don't require character typ... by TeMPOraL on Wednesday December 14, 2016 @05:23AM (#13174998)

... and then you get locked out because your domain controller (or whatever) is set up to ban you after ~3 invalid login attempts in a row. Happened to me once.

[ Parent | on HN ]

Re:New NIST password guidelines: don't require character typ... by Jaruzel on Wednesday December 14, 2016 @04:13AM (#13174728)

Which is why in a lot of corporate systems, the password history is set to 13 last passwords. a) it prevents a 0-9 rotation, and b) it also prevents people rolling passwords based on month name or number.

[ Parent | on HN ]

Re:New NIST password guidelines: don't require character typ... by daneyh on Wednesday December 14, 2016 @04:36AM (#13174824)

August2016 September2016 October2016 etc.

pls don't hack me

[ Parent | on HN ]

Re:New NIST password guidelines: don't require character typ... by Jaruzel on Wednesday December 14, 2016 @05:20AM (#13174988)

I didn't say it was a good system ;)

As the implementer, I've argued many times about it, but the ITSec bods always think they know best.

[ Parent | on HN ]

Re:New NIST password guidelines: don't require character typ... by MereInterest on Wednesday December 14, 2016 @07:33AM (#13175486)

Do they put a maximum on how many times you can change your password? If not, you could just cycle through 13 passwords in 5 minutes, then switch back to your original password.

[ Parent | on HN ]

Re:New NIST password guidelines: don't require character typ... by mlnhd on Wednesday December 14, 2016 @08:49AM (#13175888)

I wrote a PowerShell script that does exactly this for Windows Domains.

http://pastebin.com/raw/ytwy0nCB

[ Parent | on HN ]

Re:New NIST password guidelines: don't require character typ... by Jaruzel on Friday December 23, 2016 @06:32AM (#13244246)

In AD there is a MinPasswordAge policy that is typically set to 1 day to thwart exactly this type of work-around.

[ Parent | on HN ]

Re:New NIST password guidelines: don't require character typ... by gpderetta on Wednesday December 14, 2016 @06:14AM (#13175180)

That's what hexadecimal digits are for :)

[ Parent | on HN ]

Re:New NIST password guidelines: don't require character typ... by dzdt on Wednesday December 14, 2016 @04:31AM (#13174805)

Why is why password rolling is then based on an alphabetical roll, or pure numerical increment, or month and year. No real entropy gain!

[ Parent | on HN ]