Coming soon - Get a detailed view of why an account is flagged as spam!
view details

This post has been de-listed

It is no longer included in search results and normal feeds (front page, hot posts, subreddit posts, etc). It remains visible only via the author's post history.

10
Can someone explain NIST password guidelines advice conflict?
Post Flair (click to view more posts with a particular flair)
Post Body

From NIST SP 800-63B, Is this a conflict or am I reading it wrong?

"When processing requests to establish and change memorized secrets, verifiers SHALL compare the prospective secrets against a list that contains values known to be commonly-used, expected, or compromised. For example, the list MAY include, but is not limited to:
• Passwords obtained from previous breach corpuses.
• Dictionary words.
• Repetitive or sequential characters (e.g. ‘aaaaaa’, ‘1234abcd’).
• Context-specific words, such as the name of the service, the username, and derivatives thereof."

But then it goes on to say:
"Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets."

So on the one hand they are saying check for repetitive characters but then saying one should not impose composition rules that prohibit repeated characters??

Also mixed character types should no longer be used (alpha numeric caps_lower)?

Author
Account Strength
100%
Account Age
10 years
Verified Email
Yes
Verified Flair
No
Total Karma
77,347
Link Karma
16,166
Comment Karma
60,834
Profile updated: 6 hours ago

Subreddit

Post Details

We try to extract some basic information from the post title. This is not always successful or accurate, please use your best judgement and compare these values to the post title and body for confirmation.
Posted
4 months ago