News for hackers. Stuff that matters.

A comment on 49% of workers, forced to change passwords, reuse same one with minor change. Parent comment

Re:49% of workers, forced to change passwords, reuse same on... by tatersolid on Saturday December 14, 2019 @06:11AM (#21788903)
Yes, if you’re not actually doing the “compare password against breach lists” part of SP 800-63B regularly they likely won’t accept it.

I hope forced expiry will be gone from next PCI revision anyway.

[ Parent | on HN ]
Re:49% of workers, forced to change passwords, reuse same on... by alanning on Saturday December 14, 2019 @07:48AM (#21789251)
Do you happen to have a library/tool you could recommend that helps with this or did you develop something in-house?

My startup is implementing most of the NIST rec’s with the help of projects like zxcvbn but we would like to also start doing breach list comparisons so figured I’d ask.

[ Parent | on HN ]
Re:49% of workers, forced to change passwords, reuse same on... by tatersolid on Monday December 16, 2019 @02:12PM (#21806048)
We use the NTLM version of the haveibeenowned lists plus a power shell script from https://github.com/MichaelGrafnetter/DSInternals/blob/master...
[ Parent | on HN ]
Re:49% of workers, forced to change passwords, reuse same on... by djhn on Saturday December 14, 2019 @08:28AM (#21789408)
H8mail on Github and the APIs it connects to.
[ Parent | on HN ]