New NIST password guidelines: don't require character types or rotation

Re:New NIST password guidelines: don't require character typ... by criddell on Wednesday December 14, 2016 @08:15AM (#13175701)

I have one passphrase that I've memorized and that gets me into my password manager. I couldn't tell you any of my passwords other than that one. I also use two factor authentication in the form of TOTP (the 6 digit number that changes every 30 seconds) wherever I can.

If so many sites didn't have a limit on password length, I would use UUIDs.

BTW, is there any reason to have a short limit on password length? I'm talking less than 20 characters? I could understand limiting it to 100 characters, but when it's short it makes me feel like the site might be storing my password rather than a hash.

[ Parent | on HN ]

Re:New NIST password guidelines: don't require character typ... by tuwtuwtuw on Wednesday December 14, 2016 @10:39AM (#13176747)

If you only have the password to your password manager, how do you log on to your computer?

Honest question since I want a solution to that problem. I want separate credentials for my home and office computer so even though I use a password manager I have like 3-4 sensitive passwords I have to keep in my head.

[ Parent | on HN ]

Re:New NIST password guidelines: don't require character typ... by criddell on Wednesday December 14, 2016 @10:58AM (#13176908)

My laptop has a fingerprint sensor that I use. There is a backup password but I don't know what it is but I do have it in my password manager that I can access from my phone.

My office computer has a relatively weak password because there's nothing on it that is personally sensitive. They force a password change every three months so I added a counter to the password and just increment that each time (pa$$1word, pa$$2word, pa$$3word, etc...).

[ Parent | on HN ]

Re:New NIST password guidelines: don't require character typ... by logicuce on Wednesday December 14, 2016 @11:31PM (#13182424)

Isn't fingerprint based authentication considered, generally, weaker than that based on a password?

[ Parent | on HN ]

Re:New NIST password guidelines: don't require character typ... by criddell on Thursday December 15, 2016 @11:06AM (#13185510)

I might be wrong, but I believe a fingerprint is equivalent to around 80 bits of entropy which is roughly the strength of a good 13 character password.

A determined adversary can do things like lift a fingerprint from elsewhere and use that, but it's not really something I worry about too much. They could also arrest me and press my finger down on the sensor or beat me and I'll tell them every password I can.

I mostly worry about having strong credentials to remote systems.

[ Parent | on HN ]