Re:Technical report on DNC hack [pdf]
by willstrafach on Thursday December 29, 2016 @07:38PM
(#13281552)
What? The old suggestion which government/enterprise followed was quarterly password changes/rotation. This is no longer recommended by NIST though. How is that bad?
NGOs, private industry and the US government at most levels there has been a movement away from password length limits and password expiration and SMS as a second factor. (Even OTP and hashes may be replaced by U2F keys someday.)
Then we get this recommendation for password expirations.
Two steps forward, one back -- as always.