NIST advises services to not require that passwords be changed periodically

Re:NIST advises services to not require that passwords be ch... by lholden on Saturday May 20, 2017 @01:58PM (#14383509)

"The National Institute of Standards and Technology (NIST) is no longer recommending people periodically change their passwords as part of the organization’s new draft of its Digital Identity Guidelines."

Untrue, misleading, and possibly harmful.

NIST isn't recommending USERS stop changing their passwords. That would be insane. They are recommending that services stop enforcing periodic password changes on users because it ends up hurting the user in the long run. (Ie, passwords should be easy for users and hard for attackers).

[ Parent | on HN ]

Re:NIST advises services to not require that passwords be ch... by ScottBurson on Saturday May 20, 2017 @02:37PM (#14383670)

I think the keyword is "periodically". They're not saying not to change passwords for any reason; they're just saying not to do it solely because the password has been in use for some fixed amount of time. That recommendation applies to users as well as to services setting password policy.

[ Parent | on HN ]

Re:NIST advises services to not require that passwords be ch... by devonkim on Saturday May 20, 2017 @03:20PM (#14383868)

Yeah, I think the title could be better stated as "NIST Advises Against Mandatory Password Rotation Policies."

[ Parent | on HN ]