New NIST password guidelines: don't require character types or rotation

Re:New NIST password guidelines: don't require character typ... by wslh on Wednesday December 14, 2016 @09:50AM (#13176320)

Trezor is an external device (like an smart card) that you have with you, not an external system that you can abuse.

[ Parent | on HN ]

Re:New NIST password guidelines: don't require character typ... by noxToken on Wednesday December 14, 2016 @10:08AM (#13176440)

I meant the wait time increase. If I don't like you (or am just a jerk in general), I'll just write a script to automatically retry 0000 after the lockout period. I'm not trying to break into your account; I'm just hassling you with a DoS attack.

[ Parent | on HN ]

Re:New NIST password guidelines: don't require character typ... by wslh on Wednesday December 14, 2016 @10:43AM (#13176776)

I understand that and it is right but in the case of having a personal device with you, this attack will be stealing a physical object.

[ Parent | on HN ]