News for hackers. Stuff that matters.

A comment on New NIST password guidelines: don't require character types or rotation. Parent comment

Re:New NIST password guidelines: don't require character typ... by PwdRsch on Wednesday December 14, 2016 @04:53PM (#13179997)
Yep, unfortunately for passphrases the maximum acceptable password length on web sites tends to be the #1 factor limiting their use. I created sample passphrases and tried them on a handful of different sites to measure the problem. See starting slide 31 in this presentation (PDF): http://www.passwordresearch.com/files/How%20Secure%20Are%20M...
[ Parent | on HN ]
Re:New NIST password guidelines: don't require character typ... by criddell on Thursday December 15, 2016 @11:09AM (#13185541)
Do you know why sites would set a low limit? I can understand limiting to, say, a couple hundred characters, but 16 is ridiculous. These days, all anybody is going to store is a salted hash so the passphrase length should be mostly irrelevant.

Edit: that's a pretty nice slide deck. Thanks for the pointer.

[ Parent | on HN ]
Re:New NIST password guidelines: don't require character typ... by dragonwriter on Thursday December 15, 2016 @11:10AM (#13185566)
> These days, all anybody is going to store is a salted hash so the passphrase length should be mostly irrelevant.

Since I still run into services where the "forgot password" mechanism emails your current password in the clear, this is unfortunately not as true as one would hope.

[ Parent | on HN ]