News for hackers. Stuff that matters.
Re:New NIST password guidelines: don't require character typ... by gmiller123456 on Friday December 16, 2016 @10:16AM (#13193789)
Actually, no. This is about "memorized secrets", not "secrets stored somewhere else". That's not to say that secrets stored somewhere else can't be better than passwords in certain situations, they're just a different type of authentication. A password is "something you know", and stored password is "something you have". Some systems are required to use different types of authentication, one thing you know, one thing you have, and one thing about you (e.g. fingerprint/retina scan). Allowing a copy and paste from a different source violates the "something you know" requirement.

There are no comments on this comment yet.