Comment

Comment on NIST proposes barring some of the most nonsensical password rules

NotMyOldRedditName@lemmy.world ⁨3⁩ ⁨months⁩ ago

But they mess that up with their 8 char rule

Verifiers and CSPs SHALL require passwords to be a minimum of eight characters in length and SHOULD require passwords to be a minimum of 15 characters in length.

I’d they’d just said shall require 15 but not require special chars then that’s okay, but they didn’t.

Then you end up with the typical shitty manager who sees this, and says they recommend 8 and no special chars, and that’s what it becomes.

source

Sort:hotnew top

lvxferre@mander.xyz ⁨3⁩ ⁨months⁩ ago
I don’t think that the entity should be blamed for the shitty manager. Specially given that the document has a full section (appendix A.2) talking about pass length.

source
- NotMyOldRedditName@lemmy.world ⁨3⁩ ⁨months⁩ ago
  The entity knows people will follow what they day. There’s already someone in the comment section saying they’re now fighting what these lax rules allow.
  
  source
  - lvxferre@mander.xyz ⁨3⁩ ⁨months⁩ ago
    What you’re proposing is effectively the same as "they should publish inaccurate guidelines that do not actually represent their informed views on the matter, misleading everybody, to pretend that they can prevent the stupid from being stupid." It defeats the very reason why guidelines exist - to guide you towards the optimal approach in a given situation.
    
    And sometimes the optimal approach is not a bigger min length. Convenience and possible vectors of attack play a huge role; if
    
    due to some input specificity, typing out the password is cumbersome, and
    
    there’s no reasonable way to set up a password manager in that device, and
    
    your blocklist of compromised passwords is fairly solid, and
    
    you’re reasonably sure that offline attacks won’t work against you, then
    
    min 8 chars is probably better. Even if that shitty manager, too dumb to understand that he shouldn’t contradict the “SHOULD [NOT]” points without a good reason to do so, screws it up. (He’s likely also violating the “SHALL [NOT]” points, since he used the printed copy of the guidelines as toilet paper.)
    
    source