NIST proposes barring among the most nonsensical password rules

The National Institute of Standards and Technology (NIST), the federal body that sets technology standards for governmental agencies, standards organizations, and personal firms, has proposed barring among the most vexing and nonsensical password requirements. Chief amongst them: mandatory resets, required or restricted use of certain characters, and using security questions.

Selecting strong passwords and storing them safely is one of the difficult parts of a great cybersecurity regimen. Tougher still is complying with password rules imposed by employers, federal agencies, and providers of online services. Incessantly, the foundations—ostensibly to reinforce security hygiene—actually undermine it. And yet, the nameless rulemakers impose the necessities anyway.

Stop the madness, please!

Last week, NIST released its second public draft of SP 800-63-4, the most recent version of its Digital Identity Guidelines. At roughly 35,000 words and full of jargon and bureaucratic terms, the document is sort of not possible to read all through and just as hard to know fully. It sets each the technical requirements and really useful best practices for determining the validity of methods used to authenticate digital identities online. Organizations that interact with the federal government online are required to be in compliance.

A bit dedicated to passwords injects a big helping of badly needed common sense practices that challenge common policies. An example: The brand new rules bar the requirement that end users periodically change their passwords. This requirement got here into being many years ago when password security was poorly understood, and it was common for people to decide on common names, dictionary words, and other secrets that were easily guessed.

Since then, most services require using stronger passwords made up of randomly generated characters or phrases. When passwords are chosen properly, the requirement to periodically change them, typically each one to a few months, can actually diminish security since the added burden incentivizes weaker passwords which can be easier for people to set and remember.

One other requirement that always does more harm than good is the required use of certain characters, akin to a minimum of one number, one special character, and one upper- and lowercase letter. When passwords are sufficiently long and random, there’s no profit from requiring or restricting using certain characters. And again, rules governing composition can actually result in people selecting weaker passcodes.

The most recent NIST guidelines now state that:

• Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of various character types) for passwords and
• Verifiers and CSPs SHALL NOT require users to vary passwords periodically. Nonetheless, verifiers SHALL force a change if there’s evidence of compromise of the authenticator.

(“Verifiers” is bureaucrat speak for the entity that verifies an account holder’s identity by corroborating the holder’s authentication credentials. Short for credential service provider, “CSPs” are a trusted entity that assigns or registers authenticators to the account holder.)

In previous versions of the rules, among the rules used the words “mustn’t,” which suggests the practice shouldn’t be really useful as a best practice. “Shall not,” against this, means the practice have to be barred for a corporation to be in compliance.

The most recent document incorporates several other common sense practices, including:

1. Verifiers and CSPs SHALL require passwords to be a minimum of eight characters in length and SHOULD require passwords to be a minimum of 15 characters in length.
2. Verifiers and CSPs SHOULD permit a maximum password length of a minimum of 64 characters.
3. Verifiers and CSPs SHOULD accept all printing ASCII [RFC20] characters and the space character in passwords.
4. Verifiers and CSPs SHOULD accept Unicode [ISO/ISC 10646] characters in passwords. Each Unicode code point SHALL be counted as a single character when evaluating password length.
5. Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of various character types) for passwords.
6. Verifiers and CSPs SHALL NOT require users to vary passwords periodically. Nonetheless, verifiers SHALL force a change if there’s evidence of compromise of the authenticator.
7. Verifiers and CSPs SHALL NOT permit the subscriber to store a touch that’s accessible to an unauthenticated claimant.
8. Verifiers and CSPs SHALL NOT prompt subscribers to make use of knowledge-based authentication (KBA) (e.g., “What was the name of your first pet?”) or security questions when selecting passwords.
9. Verifiers SHALL confirm all the submitted password (i.e., not truncate it).

Critics have for years called out the folly and harm resulting from many commonly enforced password rules. And yet, banks, online services, and government agencies have largely clung to them anyway. The brand new guidelines, should they change into final, aren’t universally binding, but they may provide persuasive talking points in favor of casting off the nonsense.

NIST invites people to submit comments on the rules to dig-comments@nist.gov by 11:59 pm Eastern Time on October 7.