 🥳 NIST is making updates to their #password standards: Goodbye unnecessary rotations & hello longer maximum password length! (Fun fact: Tuta has no password length limits 😎) What do you think of these changes? How do you create your passwords securely? 35 comments
   @Tutanota So, my elementary school-era email passwords are still far beyond the ability of modern computers to crack. Neat!  @Tutanota Ah, long passwords. My WiFi system has a 40 character password. Which works fine with everything except one particular IoT device, which says "password too long" and refuses to operate. Tech support just said "use a shorter password". Despite most of the interweb saying that it can be up to 63 characters.  @Elatan For the previous charts they assumed MD5 hashing, for 2024 they assume bcrypt.
https://www.hivesystems.com/blog/are-your-passwords-in-the-green @Tutanota @Tutanota because governments can throw a lot more resources at your password than a random hacker. Do they care to is an open question - for your personally probably not - but NIST is advising people who foreign governments are willing to throw as many resources as they can at. (Ie the password that unlocks nuclear bombs) @Tutanota Hey cool. Most of my memorized passwords are in the 7-30 year range. Not TOO bad... @Tutanota I’m not sure about other peoples perspective but I can live (or die) with 2qn - whatever that means. Sounds like long time to me.  @Tutanota it would be more fair to the reader to mention that these crack times apply to stolen password hash files. That's why, in the case of an IT security breach, you get a notice to change your password. Most login interfaces have a max attempt limit and a timer, in which case this table does not apply at all. @Tutanota Dictionary words spelled correctly are good, so long as there is more than one and they are random words. A phase is good but it needs to be more words because phase often from someplace people would guess. The idea is you want something that is nearly as unlikely as random garbage, but much easier to remember. @Tutanota Well, it depends. If you’re doing eCommerce, the PCI DSS v4.0 still requires regular password rotation (ok, with a maximum interval of 1year, but still) 😎 @Linkshaender @Tutanota most likely for another reason: to ensure no one that was in a company and got the password can use it forever even when leaving the company @simonlevesque as the PCI DSS also requires MFA, so I do hope that should not be possible. @Tutanota @Tutanota While that is possible it is unlikely. Anyone sane doing these checks will have 10,000 or more common passwords they check first before they start the random search. And they will likely do their random search with shorter combinations as well. In fact if they don't know the length of your password (which no sane password storage will give you) they probably won't even try if your password is long because the odds of them ever getting it are too low to bother. @zoe @Tutanota because they only threw twelve consumer graphics card at it. If you are the NSA and have several datacenters full of graphics cards, a few thousand years on this chart quickly become wayyy shorter. Another factor is that computers are getting faster, which also reduces the cracking time in the future. And in case someone finds an attack against the hash algorithm, that can reduce it by orders of magnitude as well... |
Gregory's Server
@Tutanota My password manager creates them. But I play around with the options.