New NIST password guidelines: don't require character types or rotation

Re:New NIST password guidelines: don't require character typ... by GrinningFool on Wednesday December 14, 2016 @01:48PM (#13178556)

Thanks for the reply. Sounds like another case of "we've always done it this way".

I feel like underlying all of this, there's a lagging perception that "spaces and special characters are hard". But when all you're doing is hashing them... they're really really not. Whenever I hit a max length limitation, I'm automatically assuming that particular password is being kept in plaintext.

[ Parent | on HN ]

Re:New NIST password guidelines: don't require character typ... by wolfgang42 on Thursday December 15, 2016 @09:09PM (#13190505)

Max length limits can also be imposed by actual cryptographic hashes. (8-char limits are admittedly implausible.) For example, bcrypt is generally considered a good idea for storing passwords, but has a length limit of somewhere around 55 bytes (http://security.stackexchange.com/questions/39849/does-bcryp... for details).

[ Parent | on HN ]