At last!!! A good reason not to create dozens of hard-to-remember passwords! The updated National Institute for Standards and Technology guidance on creating passwords has been out for a while now, but the word has been slow in trickling down to end users. It’s time to pay attention, because the recommendations represent a huge departure from standard practice. First, the good news:
NIST is part of the US Department of Commerce and an authoritative standards-making body. It is the entity that wrote the primer on how to create all those complex and hard-to-remember passwords in the first place. You know, passwords like *Pa$$w)rd3! NIST now acknowledges through this publication that the old rules affected usability negatively. It also turns out that passwords composed of a few common words strung together are far stronger than upper-lower-numbers-characters passwords, so the old way was less secure than we thought.
It’s big news then that NIST has seen the error of its ways and now recommends creating passwords we can remember. Even more important, it also now recommends that a password not be changed unless there is an indicator it has been compromised or forgotten by the user. Of course, being the government, calling a password a password is just too hard. The term in NIST SP800-63B 2017 is “Memorized Secret Authenticator.” Whatever you choose to call it, user guidance is simple:
Continue Reading dyktthctgohtcp?