News for hackers. Stuff that matters.

A comment on New NIST password guidelines: don't require character types or rotation. Parent comment

Re:New NIST password guidelines: don't require character typ... by criddell on Thursday December 15, 2016 @11:09AM (#13185541)
Do you know why sites would set a low limit? I can understand limiting to, say, a couple hundred characters, but 16 is ridiculous. These days, all anybody is going to store is a salted hash so the passphrase length should be mostly irrelevant.

Edit: that's a pretty nice slide deck. Thanks for the pointer.

[ Parent | on HN ]
Re:New NIST password guidelines: don't require character typ... by dragonwriter on Thursday December 15, 2016 @11:10AM (#13185566)
> These days, all anybody is going to store is a salted hash so the passphrase length should be mostly irrelevant.

Since I still run into services where the "forgot password" mechanism emails your current password in the clear, this is unfortunately not as true as one would hope.

[ Parent | on HN ]