News for hackers. Stuff that matters.

A comment on Technical report on DNC hack [pdf]. Parent comment

Re:Technical report on DNC hack [pdf] by ue_ on Thursday December 29, 2016 @04:38PM (#13280364)
If I recally correctly, NIST recently issued guidelines specifically against password expiration/recycling and against forced limits on what characters you can have in your password.
[ Parent | on HN ]
Re:Technical report on DNC hack [pdf] by khrakhen on Thursday December 29, 2016 @04:47PM (#13280432)
Yep. All the more infuriating. They know better.

NGOs, private industry and the US government at most levels there has been a movement away from password length limits and password expiration and SMS as a second factor. (Even OTP and hashes may be replaced by U2F keys someday.)

Then we get this recommendation for password expirations.

Two steps forward, one back -- as always.

[ Parent | on HN ]
Re:Technical report on DNC hack [pdf] by willstrafach on Thursday December 29, 2016 @07:38PM (#13281552)
What? The old suggestion which government/enterprise followed was quarterly password changes/rotation. This is no longer recommended by NIST though. How is that bad?
[ Parent | on HN ]