News for hackers. Stuff that matters.

A comment on New NIST password guidelines: don't require character types or rotation. Parent comment

Re:New NIST password guidelines: don't require character typ... by Spooky23 on Wednesday December 14, 2016 @09:20AM (#13176080)
Think about this problem in context with the NIST trust level framework.

Nobody gives a shit about low trust environments... go ahead and crack my slashdot account, but higher trust stuff like mail, money, network access etc absolutely need MFA.

[ Parent | on HN ]
Re:New NIST password guidelines: don't require character typ... by kbart on Wednesday December 14, 2016 @09:33AM (#13176167)
That's my point. MFA itself is certainly a very useful security solution (for example, I wouldn't trust a bank that doesn't use it), but "MFA everywhere" is not a way to go, because I value my privacy more than some useless Internet account.
[ Parent | on HN ]