Trump’s cell phone use is security “nightmare” waiting to happen, lawmakers say

Re:Trump’s cell phone use is security “nightmare” waiting to... by sigsergv on Friday April 27, 2018 @12:02AM (#16938378)

> A trivial example: IT requires users to change their passwords every N days. So users start with "password", and when they are required to change it, they use "password1", then "password2", and so on.

Fortunately in the latest NIST Digital Identity Guidelines this case is explicitly discouraged [1]: Do not require that memorized secrets be changed arbitrarily (e.g., periodically) unless there is a user request or evidence of authenticator compromise.

[1]: https://pages.nist.gov/800-63-3/sp800-63b.html#usabilitycomm...

[ Parent | on HN ]

Re:Trump’s cell phone use is security “nightmare” waiting to... by wink on Saturday April 28, 2018 @04:23PM (#16949262)

First of all, NIST - not saying it's useless worldwide, but we're not bound and so it's probably ignored.

Second, good luck until something like this 2017? guideline makes it into the big non-IT corporations, NGOs and governments. maybe 2022? :)

[ Parent | on HN ]