No relation to the sports channel.

  • 0 Posts
  • 15 Comments
Joined 3 years ago
cake
Cake day: June 9th, 2023

help-circle










  • One problem is that a great deal of correct security advice contradicts “common knowledge” security practices. Password character classes – “must include capitals, lowercase, numbers, and symbols” – are a standard example. That idea got rooted in security requirements for banks and such, and it was a bad idea even then.

    But getting rid of that idiocy looks, to the casual observer, like “weakening password requirements”.

    Another problem is that the biggest security vulnerability that many businesses have is obedience to authority. If you can “social-engineer” someone into thinking you’re the big boss, then of course they’ll turn off all the security for you. And the scarier the big boss is, the more eager the underlings are to please them by doing exactly what the email from bigboss@yourcopmany.com says.

    Resistance to phishing is questioning claims of authority; it requires being willing to tell the big boss that no you won’t take the security down in response to an email, even a really convincing one. Which means that the worker has to be safe in doing so.





  • fubo@lemmy.worldtoTechnology@lemmy.worldPasswords
    link
    fedilink
    English
    arrow-up
    1
    ·
    edit-2
    2 years ago

    Since 2017 at least; and IIRC years before that; that’s just the earliest NIST publication on the subject I could find with a trivial Web search.

    https://pages.nist.gov/800-63-3/sp800-63b.html

    Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets. Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.

    “Memorized secrets” means classic passwords, i.e. a one-factor authentication through a shared secret presumed to be known to only the right person.