544

NIST proposes barring some of the most nonsensical password rules(arstechnica.com)

posted
by
Avatar
Amicitas@lemmy.world
in
Avatar
technology@lemmy.world
178 comments
hidereport

Here is the text of the NIST sp800-63b Digital Identity Guidelines.

Sort:
HotTopControversialNewOld
You are viewing a single thread.
View all comments View context
Avatar
frezik@midwest.social
4 points

Some kind of upper bound is usually sensible. You can open a potential DoS vector by accepting anything. The 72 byte bcrypt/scrypt limit is generally sensible, but going for 255 would be fine. There’s very little security to be gained at those lengths.

permalink
report
parent
reply
Avatar
sugar_in_your_tea@sh.itjust.works
1 point

I do 256 so I hopefully never need to update it, but most of my passwords are 20-30 characters or something, and generated by my password manager. I don’t care if you choose to write a poem or enter a ton of unicode, I just need a bunch of bytes to hash.

permalink
report
parent
reply

Technology

!technology@lemmy.world

Create post

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots

Community stats

  • 17K

    Monthly active users

  • 6.1K

    Posts

  • 132K

    Comments

Community moderators