NIST SP 800-63 Password Guidance now more relevant

NIST has finally rolled out the next set of updates to NISTSP 800-63.  Hopefully, these new recommendations will change the practice of frequent password resets and contribute to the creation of a more user-friendly and secure password environment.

Credit: Randall Munroe, xkcd.com, CC 2.5

The main ones as of now

1. Elimination of mandatory periodic password changes. “Verifiers and CSPs SHALL NOT require users to change passwords periodically. However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.” NIST argues that frequent password resets often lead to weaker passwords and encourage users to make minor, predictable changes. Instead, passwords should only be changed when there’s evidence of compromise.
2. Establish the block list. NIST has emphasized the importance of checking passwords against lists of commonly used or compromised passwords. NIST recommends that organizations maintain an updated blocklist of weak passwords and prevent users from selecting any password on this list.
3. For storing passwords, NIST recommends using salted hashing with a work factor that makes offline attacks computationally expensive. This approach helps protect stored passwords even if a database is compromised.
4. knowledge-based authentication (KBA) no longer recommended (e.g., “What was the name of your first pet?”) or security questions when choosing passwords.” Verifiers and CSPs SHALL NOT permit the subscriber to store a hint that is accessible to an unauthenticated claimant.”
5. Drop the algorithmic complexity song and dance (Complexity Versus Length and uniqueness)
   No more arbitrary password complexity requirements needing mixtures of upper-case letters, lower case letters, special characters, symbols, and numbers. Like frequent password changes, it’s been shown repeatedly that these types of restrictions often result in worse passwords, making it easier for hackers to exploit vulnerabilities.

• Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords.
• Verifiers and CSPs SHALL require passwords to be a minimum of eight characters in length and SHOULD require passwords to be a minimum of 15 characters in length.
• Verifiers and CSPs SHOULD permit a maximum password length of at least 64 characters.
• Verifiers and CSPs SHOULD accept all printing ASCII characters and the space character in passwords.
• Verifiers and CSPs SHOULD accept Unicode characters in passwords. Each Unicode code point SHALL be counted as a single character when evaluating password length.