The latest NIST guidelines now state that:
Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords and Verifiers and CSPs SHALL NOT require users to change passwords periodically. However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.Makes sense. Most compromises aren’t brute force attacks. Allow all the characters and any brute force that is attempted will have to assume they’re part of it.
Removing required periodical changes means people are less likely to use the same password and just increment a number added to the end. A compromised password with a setup like that is still compromised, they can make an educated guess as to what the new number is based on when was compromised compared to now.
Please don’t take those recommendations out of context.
They also recommend MFA, but people only ever bring up the “no rotation” bit.
Are they at least recommending non-SMS MFA now?
Emphasis was from the article, not mine.
They also recommend not using knowledge based prompts, allowing at least 64: characters,
This is the most excited I’ve been about a NIST standard in a good while
My favorite error is “password is too long.”
NIST SP 800-63b already did that several years ago. People just need to follow it.