News for hackers. Stuff that matters.

A comment on New NIST password guidelines: don't require character types or rotation. Parent comment

Re:New NIST password guidelines: don't require character typ... by MereInterest on Wednesday December 14, 2016 @07:33AM (#13175486)
Do they put a maximum on how many times you can change your password? If not, you could just cycle through 13 passwords in 5 minutes, then switch back to your original password.
[ Parent | on HN ]
Re:New NIST password guidelines: don't require character typ... by mlnhd on Wednesday December 14, 2016 @08:49AM (#13175888)
I wrote a PowerShell script that does exactly this for Windows Domains.

http://pastebin.com/raw/ytwy0nCB

[ Parent | on HN ]
Re:New NIST password guidelines: don't require character typ... by Jaruzel on Friday December 23, 2016 @06:32AM (#13244246)
In AD there is a MinPasswordAge policy that is typically set to 1 day to thwart exactly this type of work-around.
[ Parent | on HN ]