News for hackers. Stuff that matters.

A comment on New NIST password guidelines: don't require character types or rotation. Parent comment

Re:New NIST password guidelines: don't require character typ... by Jaruzel on Wednesday December 14, 2016 @04:13AM (#13174728)
Which is why in a lot of corporate systems, the password history is set to 13 last passwords. a) it prevents a 0-9 rotation, and b) it also prevents people rolling passwords based on month name or number.
[ Parent | on HN ]
Re:New NIST password guidelines: don't require character typ... by daneyh on Wednesday December 14, 2016 @04:36AM (#13174824)
August2016 September2016 October2016 etc.

pls don't hack me

[ Parent | on HN ]
Re:New NIST password guidelines: don't require character typ... by Jaruzel on Wednesday December 14, 2016 @05:20AM (#13174988)
I didn't say it was a good system ;)

As the implementer, I've argued many times about it, but the ITSec bods always think they know best.

[ Parent | on HN ]
Re:New NIST password guidelines: don't require character typ... by MereInterest on Wednesday December 14, 2016 @07:33AM (#13175486)
Do they put a maximum on how many times you can change your password? If not, you could just cycle through 13 passwords in 5 minutes, then switch back to your original password.
[ Parent | on HN ]
Re:New NIST password guidelines: don't require character typ... by mlnhd on Wednesday December 14, 2016 @08:49AM (#13175888)
I wrote a PowerShell script that does exactly this for Windows Domains.

http://pastebin.com/raw/ytwy0nCB

[ Parent | on HN ]
Re:New NIST password guidelines: don't require character typ... by Jaruzel on Friday December 23, 2016 @06:32AM (#13244246)
In AD there is a MinPasswordAge policy that is typically set to 1 day to thwart exactly this type of work-around.
[ Parent | on HN ]
Re:New NIST password guidelines: don't require character typ... by gpderetta on Wednesday December 14, 2016 @06:14AM (#13175180)
That's what hexadecimal digits are for :)
[ Parent | on HN ]
Re:New NIST password guidelines: don't require character typ... by dzdt on Wednesday December 14, 2016 @04:31AM (#13174805)
Why is why password rolling is then based on an alphabetical roll, or pure numerical increment, or month and year. No real entropy gain!
[ Parent | on HN ]