News on Medial

NIST proposes barring some of the most nonsensical password rules

Arstechnica · 10m ago

Medial

The National Institute of Standards and Technology (NIST) has proposed to eliminate some of the nonsensical password requirements. In their latest guidelines, NIST recommends against periodic password resets, mandatory use of certain characters, and security questions. These rules, which were originally imposed to enhance security, can actually undermine it. The new guidelines promote common-sense practices, such as using longer and more random passwords, not imposing composition rules, and not requiring frequent password changes. While the proposed guidelines are not mandatory, they can serve as persuasive arguments in favor of eliminating ineffective password rules.