New NIST password guidelines: don't require character types or rotation

Re:New NIST password guidelines: don't require character typ... by jjnoakes on Wednesday December 14, 2016 @08:24AM (#13175739)

Why wait until 3 tries? Why not just require 1 second between all attempts?

[ Parent | on HN ]

Re:New NIST password guidelines: don't require character typ... by blauditore on Wednesday December 14, 2016 @08:35AM (#13175802)

Hmm, I guess this makes sense. Not sure what I was thinking...

[ Parent | on HN ]

Re:New NIST password guidelines: don't require character typ... by viggity on Wednesday December 14, 2016 @09:42AM (#13176245)

if you're hashing with PBKDF2 and 100k+ iterations, it can take that long anyway.

[ Parent | on HN ]

Re:New NIST password guidelines: don't require character typ... by tedunangst on Wednesday December 14, 2016 @12:58PM (#13178080)

But not in parallel.

[ Parent | on HN ]

Re:New NIST password guidelines: don't require character typ... by sleavey on Wednesday December 14, 2016 @01:04PM (#13178143)

Can hashing iterations be conducted in parallel? Doesn't the next hash need the output of the last, making this a sequential operation?

[ Parent | on HN ]

Re:New NIST password guidelines: don't require character typ... by niftich on Wednesday December 14, 2016 @01:10PM (#13178194)

Both of you are correct, just talking about different things. PBKDF2 rounds are clearly sequential.

Meanwhile, you can issue multiple simultaneous requests in parallel to try to authenticate the credentials, possibly from a large bank of distinct hosts.

[ Parent | on HN ]