If I recally correctly, NIST recently issued guidelines specifically against password expiration/recycling and against forced limits on what characters you can have in your password.
Re:Technical report on DNC hack [pdf]
by khrakhen on Thursday December 29, 2016 @04:47PM
(#13280432)
Yep. All the more infuriating. They know better.
NGOs, private industry and the US government at most levels there has been a movement away from password length limits and password expiration and SMS as a second factor. (Even OTP and hashes may be replaced by U2F keys someday.)
Then we get this recommendation for password expirations.
Two steps forward, one back -- as always.
Re:Technical report on DNC hack [pdf]
by willstrafach on Thursday December 29, 2016 @07:38PM
(#13281552)
What? The old suggestion which government/enterprise followed was quarterly password changes/rotation. This is no longer recommended by NIST though. How is that bad?
Cue everyone recycling a set of 10 unique passwords among devices and/or writing passwords on Post-It notes on work computers at the office.
Only bit of truth in here was the phishing campaign. That could be anyone, however. This is barely more advanced than the Nigerian bank scam e-mails.
Yet the POTUS says it's a sign of the highest levels of Russian government.
We've already been fed lies about e-mails being altered (DKIM signatures disprove this) and now this PDF ignores the insider element in the DNC/Wasserman-Schultz leaks.
What a joke. NIST, NSA, FBI, CIA et alia should be discredited almost entirely at this point.