News for hackers. Stuff that matters.

A comment on NIST advises services to not require that passwords be changed periodically.

Re:NIST advises services to not require that passwords be ch... by milkthefat on Saturday May 20, 2017 @03:28PM (#14383916)
This is great, unfortunately considering this is only draft I imagine it will be a considerable amount of time to trickle down through the "compliance standards" we are required to enforce. I do look forward to the day I no longer have to change my password every 30 days though.
[ Parent | on HN ]
Re:NIST advises services to not require that passwords be ch... by tyingq on Saturday May 20, 2017 @03:39PM (#14383977)
Agreed. As it stands today, PCI, Sarbanes Oxley, HIPPA, and other drivers are used as hammers to force password change policies.

Even if they don't mention it directly, some audit firm tosses it in as a best practice to support something more generically stated in the standards.

[ Parent | on HN ]