• 1 Post
  • 12 Comments
Joined 1 year ago
cake
Cake day: July 2nd, 2023

help-circle
  • What you want is NIST 800-63b https://pages.nist.gov/800-63-3/sp800-63b.html#memsecret

    Specifically sections 5.1.1.1 and 5.1.1.2.

    Excerpt from 5.1.1.2 pertaining to complexity and rotation requirements:

    Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets. Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.

    Appendix A of the document contains their reasoning for changing from the previous common wisdom.

    The tl;dr of their changes boil down to length is more important than any other factor when it comes to password security.

    Edit to add:

    In my personal opinion, organizations should be trying to move away from passwords as much as possible. If your IT team seems to think this system is so important that they need to rotate passwords every month, they should probably be transitioning to hardware security tokens, passkeys, or worst case, password with non-sms MFA.

    Now I know nothing about the actual circumstances and I know there are plenty of reasons why that may not be possible in this specific case, but I’d feel remiss if I didn’t mention it.



  • Any organization still doing this is a decade behind best practices. NIST published new recommendations years ago that specified getting rid of the practice of regular forced password resets specifically because they encourage bad practices that make passwords weaker.

    Of course it doesn’t help that there are some industry compliance standards that have refused to update their requirements, but I don’t know of any that would require monthly password changes.








  • Being able to raise and lower is great. The grill is one at one of the local parks. Most of the perks around here have at least one which you can reserve.

    As for what I’m cooking on, it’s actually both! I used about 2 bundles of red oak, then a bunch of a good natural oak charcoal that I really like to help fill it out. I had more of both in reserve, but it ended up being just the right amount for what I needed.