NIST says: stop forcing password changes
The new NIST draft drops forced resets and “one symbol, one number” rules. Here’s what to do instead.
NIST’s new draft of its digital identity guidelines (SP 800-63B, revision 4) says out loud what security people have said for years. Verifiers shall not:
- force people to change passwords on a schedule,
- demand a mix of upper case, numbers and symbols,
- use password hints or security questions.
Why? Forced changes give you Summer2024!, then Autumn2024!. Composition rules give you the same predictable pattern everywhere. People aren’t the problem; the rules are.
What NIST wants instead:
- Length. At least 8 characters, preferably 15, and allow long ones (64 or more). Allow spaces, so passphrases work.
- Block bad passwords. Check new passwords against lists of breached and common ones.
- Change only when there’s a reason, such as evidence of a leak.
- MFA on anything that matters.
If your company policy still says “change every 90 days”, this is the document to show whoever wrote it.