Skip to main content

šŸ„³ NIST is making updates to their #password standards:
pages.nist.gov/800-63-4/sp800-ā€¦

Goodbye unnecessary rotations & hello longer maximum password length! (Fun fact: Tuta has no password length limits šŸ˜Ž)

What do you think of these changes? How do you create your passwords securely?

A guide from Hive Systems visualizing the time required to brute force a password in 2024.
#password
in reply to Tuta

TuxOnBike
TuxOnBike
• •
My password manager creates them. But I play around with the options.
in reply to Tuta

Tim Ward ā­šŸ‡ŖšŸ‡ŗšŸ”¶ #FBPE
Tim Ward ā­šŸ‡ŖšŸ‡ŗšŸ”¶ #FBPE
• •

Ah, long passwords.

My WiFi system has a 40 character password.

Which works fine with everything except one particular IoT device, which says "password too long" and refuses to operate. Tech support just said "use a shorter password". Despite most of the interweb saying that it can be up to 63 characters.

in reply to Tuta

a Witty Name
a Witty Name
• •
I have both Batman symbol and Prince logo. Does that help?
in reply to Tuta

Elatan
Elatan
• •
Looking at the same sheet from 2022 and am a little surprised that the same password would now be more secure than in 2022. I was expecting the opposite direction. I guess that's due to changed methodology? Or am I missing something?
A guide from Hive Systems visualizing the time required to brute force a password in 2022.
This entry was edited (1 month ago)
in reply to Tuta

cube
cube
• •
Why are passwords that take millions of year are marked as yellow, an not green?
in reply to Tuta

SomeGadgetGuy
SomeGadgetGuy
• •
Hey cool. Most of my memorized passwords are in the 7-30 year range. Not TOO bad...
in reply to Tuta

Cluster Fcku
Cluster Fcku
• •
it would be more fair to the reader to mention that these crack times apply to stolen password hash files. That's why, in the case of an IT security breach, you get a notice to change your password. Most login interfaces have a max attempt limit and a timer, in which case this table does not apply at all.
in reply to Tuta

Cognitive Dissidence
Cognitive Dissidence
• •

I use a phrase from a book, preferably one that's not too popular, then add some creative misspellings. For a hint, I can just use the book's title.

Things that I have never used in a password:

- DOB or anniversary of myself or family members
- Pet's name, current or past
- Home Town
- Any dictionary word (unless obfuscated by multiple misspellings)

What am I forgetting?

in reply to Tuta

Armin Hanisch
Armin Hanisch
• •
Well, it depends. If youā€™re doing eCommerce, the PCI DSS v4.0 still requires regular password rotation (ok, with a maximum interval of 1year, but still) šŸ˜Ž
in reply to Tuta

Johns
Johns
• •

Using a variation of: "day" "month", " year" and a symbol [$, !,?,@,ā‚¬,&]

And since I use three languages that's three ways of spelling the month.

So if I changed it today it could be:
September25!2024@
Or
!25Setembre-2024?

Not the strongest but strong enough and easy to remember

in reply to Tuta

mangymagi:~#:blinking_cursor:
mangymagi:~#:blinking_cursor:
• •
I think itā€™s important to note that the times listed is the MAXIMUM time it will take to crack the password, you could get lucky and get it on first attempt or 100 iterations in.
in reply to Tuta

meneer
meneer
• •
who cares about password length and complexity if (decent) MFA is mandatory?
in reply to meneer

Tuta
Tuta
• •
@meneer This depends largely on the kind of MFA which is accepted. A hardware key like a Nitrokey or Yubikey is far more secure than an SMS code. A weak password and weak 2fa can lead to account compromise.
@meneer
in reply to Tuta

meneer
meneer
• •
I fully agree, but any MFA is better than no MFA. TOTP through authenticator apps and hardware tokens like Yubikey or Solo are the good practices.
Passwords .. We only see passwords copied or shared (via phishing), not broken by cracking, that takes too much effort anyway. I can't recall password incidents because of brute force attacks, except for stupid breaches of websites, when a password file without decent encryption and a salt is used (like LinkedIn ages ago).
in reply to Tuta

mmphosis
mmphosis
• •
tr -cd "[:graph:]" < /dev/urandom | head -c 97 | xargs -0
in reply to Tuta

BoBwalker
BoBwalker
• •
Yes.. BUT .. Most servers boot Login attempts after 3 errors.
in reply to Tuta

zoe
zoe
• •
/genq why is 33k years orange. i wont live half a percent of that
in reply to Tuta

taivlam
taivlam
• •
It's still gonna be a while before universities and companies stop unnecessary password rotations for practices IRL.
ā‡§