New NIST password guidelines: don't require character types or rotation

Re:New NIST password guidelines: don't require character typ... by rrobukef on Wednesday December 14, 2016 @04:16AM (#13174745)

Heh, I often have more than 3 wrong password attempts. Lockout is a really bad idea for me.

[ Parent | on HN ]

Re:New NIST password guidelines: don't require character typ... by viggity on Wednesday December 14, 2016 @09:47AM (#13176286)

I worked for a State government about 10 years ago. Some asshole managed to lock every single user's account by having a script attempt a login with an invalid password 10 times. Nobody could work for ~7 hours.

[ Parent | on HN ]

Re:New NIST password guidelines: don't require character typ... by jessaustin on Wednesday December 14, 2016 @01:15PM (#13178235)

s/asshole/volunteer pentester/

[ Parent | on HN ]

Re:New NIST password guidelines: don't require character typ... by richmarr on Wednesday December 14, 2016 @06:26AM (#13175227)

Context is also relevant.

The iPhone for example has a PIN lockout, and young kids love phones.

More than once I've been punished by Apple for my kids curiosity.

[ Parent | on HN ]

Re:New NIST password guidelines: don't require character typ... by cdubzzz on Wednesday December 14, 2016 @08:29AM (#13175766)

You can disable this in Settings -> Touch ID and Passcode using the Erase Data toggle.

[ Parent | on HN ]

Re:New NIST password guidelines: don't require character typ... by stolsvik on Wednesday December 14, 2016 @05:20PM (#13180205)

Not if your company overrides the settings. At my job, 5 is the limit, and then the phone is wiped. Seriously.

[ Parent | on HN ]