this post was submitted on 26 Sep 2024
91 points (100.0% liked)

Cybersecurity

5631 readers
109 users here now

c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.

THE RULES

Instance Rules

Community Rules

If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.

Learn about hacking

Hack the Box

Try Hack Me

Pico Capture the flag

Other security-related communities !databreaches@lemmy.zip !netsec@lemmy.world !cybersecurity@lemmy.capebreton.social !securitynews@infosec.pub !netsec@links.hackliberty.org !cybersecurity@infosec.pub !pulse_of_truth@infosec.pub

Notable mention to !cybersecuritymemes@lemmy.world

founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
[–] linearchaos@lemmy.world 39 points 1 month ago (4 children)

The latest NIST guidelines now state that:

Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords and
Verifiers and CSPs SHALL NOT require users to change passwords periodically. However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.
[–] UID_Zero@infosec.pub 7 points 1 month ago (2 children)

Please don’t take those recommendations out of context.

They also recommend MFA, but people only ever bring up the “no rotation” bit.

[–] Zorsith@lemmy.blahaj.zone 5 points 1 month ago

Are they at least recommending non-SMS MFA now?

[–] linearchaos@lemmy.world 4 points 1 month ago

Emphasis was from the article, not mine.

They also recommend not using knowledge based prompts, allowing at least 64: characters,

load more comments (1 replies)