News for hackers. Stuff that matters.

A comment on New NIST password guidelines: don't require character types or rotation. Parent comment

Re:New NIST password guidelines: don't require character typ... by sh_tinh_hair on Wednesday December 14, 2016 @09:13AM (#13176041)
MFA is basically another key|password. If I am not careful with my secret key and password what difference does it make that there are two of them?

No, security is tough. The better security the less useful it is. NIST got this right. Do what you can, don't kill the user and implement security on the aaa side.

[ Parent | on HN ]
Re:New NIST password guidelines: don't require character typ... by Spooky23 on Wednesday December 14, 2016 @01:18PM (#13178259)
Have you ever messed with a friend by locking out their phone?

I was specifically addressing the DoS vulnerability of locking an organization out en masse by taking advantage of account lockout or timeout policy. A list of emails and a six line script could take a whole company offline.

MFA can be used to address that by requiring pre-auth before you can enter a password.

[ Parent | on HN ]