News for hackers. Stuff that matters.

A comment on There’s no need to change passwords if they're robust, unique and not breached. Parent comment

Re:There’s no need to change passwords if they're robust, un... by ryangittins on Friday March 04, 2022 @09:15AM (#30555017)
NIST actually changed their recommendation relatively recently and no longer suggests periodic password changes without reason.

> Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.

Source: https://pages.nist.gov/800-63-3/sp800-63b.html#memsecretver

[ Parent | on HN ]
Re:There’s no need to change passwords if they're robust, un... by _wldu on Friday March 04, 2022 @09:41AM (#30555438)
Yes, and I believe they initially made this change in June 2017 (almost 5 years ago now). IT audit/compliance is typically 5 to 10 years behind best security practices and some standards are even slower to catch up.
[ Parent | on HN ]
Re:There’s no need to change passwords if they're robust, un... by ryangittins on Friday March 04, 2022 @09:43AM (#30555473)
Welp, I guess I am now old enough that 5 years ago "relatively recently." :/
[ Parent | on HN ]