News for hackers. Stuff that matters.

A comment on There’s no need to change passwords if they're robust, unique and not breached. Parent comment

Re:There’s no need to change passwords if they're robust, un... by nend on Friday March 04, 2022 @09:12AM (#30554966)
This has been a standard IT policy for companies in the US for like 20 years. Probably 3/4 of the companies I've worked at over that time anyway.
[ Parent | on HN ]
Re:There’s no need to change passwords if they're robust, un... by ryangittins on Friday March 04, 2022 @09:15AM (#30555017)
NIST actually changed their recommendation relatively recently and no longer suggests periodic password changes without reason.

> Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.

Source: https://pages.nist.gov/800-63-3/sp800-63b.html#memsecretver

[ Parent | on HN ]
Re:There’s no need to change passwords if they're robust, un... by _wldu on Friday March 04, 2022 @09:41AM (#30555438)
Yes, and I believe they initially made this change in June 2017 (almost 5 years ago now). IT audit/compliance is typically 5 to 10 years behind best security practices and some standards are even slower to catch up.
[ Parent | on HN ]
Re:There’s no need to change passwords if they're robust, un... by ryangittins on Friday March 04, 2022 @09:43AM (#30555473)
Welp, I guess I am now old enough that 5 years ago "relatively recently." :/
[ Parent | on HN ]
Re:There’s no need to change passwords if they're robust, un... by kasey_junk on Friday March 04, 2022 @09:15AM (#30555006)
I think the question is do people naturally change old passwords without such policies.

The policies are the problem and the industry has recognized it so they’ve moved away from those recommendations.

[ Parent | on HN ]
Re:There’s no need to change passwords if they're robust, un... by Cr0s on Friday March 04, 2022 @09:22AM (#30555119)
Yes, this basically. Sure if you have to change your password you will, but if there is nothing compelling you to do so why do it? And if yes, why.
[ Parent | on HN ]