News for hackers. Stuff that matters.
Re:South African bank advises against the use of password ma... by sonnk on Monday August 19, 2019 @09:48AM (#20737697)
I can understand if a government service requires this but it also happens with a normal, ecommerce website!
Re:South African bank advises against the use of password ma... by kelnage on Monday August 19, 2019 @09:58AM (#20737773)
If it's a US Federal Government service, you should point out to them that they are going against the explicit recommendation of NIST[1].

1. https://pages.nist.gov/800-63-3/sp800-63b.html#sec5, under 5.1.1.2 Memorized Secret Verifiers, 'Verifiers SHOULD permit claimants to use “paste” functionality when entering a memorized secret.'

Re:South African bank advises against the use of password ma... by 0xffff2 on Monday August 19, 2019 @01:52PM (#20739998)
Sadly the US Federal Government is a massive and unwieldy collection of organizations. I work in the Federal government and my part of it doesn't comply with NIST's modern guidelines at all. They probably will at some point, but department/agency level IT changes take years to be approved.
Re:South African bank advises against the use of password ma... by moviuro on Monday August 19, 2019 @09:52AM (#20737731)
I really don't understand why. Please explain.
Re:South African bank advises against the use of password ma... by mcv on Monday August 19, 2019 @09:58AM (#20737776)
I do not understand why a government service would require this. Governments should improve security, not undermine it.

(Then again, most governments don't seem to care much about what I think they should be doing.)

Re:South African bank advises against the use of password ma... by sonnk on Monday August 19, 2019 @11:11AM (#20738436)
The generated password is usually just random string and hard to memorise. If you need to use the password outside of the web, e.g. on telephone or in a physical office, then it makes sense to use a password you creates. This is similar to the "master password" used by password manager, you should remember it by heart instead of generating a random one.
Re:South African bank advises against the use of password ma... by dsfasfasfas on Monday August 19, 2019 @10:41AM (#20738149)
Well in my little corner of the US govt the web certificates are usually expired and I can't log into my work email from home.
Re:South African bank advises against the use of password ma... by 0xffff2 on Monday August 19, 2019 @01:54PM (#20740027)
Are they actually expired? In both corners of the US government that I've worked most of the certificates are self-signed and work computers have the agency's root certs added to the browser.