topic Re: Dustin Got It Right in Tech Talk

Dustin Got It Right

CraginS — Sun, 01 Dec 2019 14:03:56 GMT

Dustin's 12/1/2019 Sunday Comic got two things right in a commentary on passwords:

https://www.comicskingdom.com/shared_comics/2e258750-c12c-4c5c-8928-e4bea6bee071

1. Treating all passwords as if they are protecting the same level of highly sensitive information or extreme risk is silly.

2. Continuing the broadly enforced out of date password complexity and refresh rules is not only cumbersome, but stupid.

Craig

Re: Dustin Got It Right

ericgeater — Mon, 02 Dec 2019 00:11:49 GMT

Without quoting Randall Munroe's sublime password demystifying cartoon myself (I'll let this Gizmodo article do that for me!), I remember reading how a retired NIST bureaucrat admitted that he wrote bad password creation guidance -- but only after he left his role.

Maybe at some point, someone will revise 800-63 Appendix A by appending it to say "or just use a thirty character passphrase, and at least *consider* adding MFA."