On Fri, Dec 3, 2021 at 1:17 PM Kurt Seifried <k...@seifried.org> wrote:
> Not Using Password Aging - (262)
> https://cwe.mitre.org/data/definitions/262.html
> Password Aging with Long Expiration - (263)
> https://cwe.mitre.org/data/definitions/263.html
> REFERENCES needs updating with:
> https://pages.nist.gov/800-63-3/sp800-63b.html

+1. You never throw away a good secret based on [misguided] policy.

>From Security UX studies, we know each time a user is required to come
up with a new password, the new password gets weaker and weaker until
it approaches a minimum.

Here's a better reference. Peter Gutmann stated this long before NIST,
and he even cited the Security UX studies:


Reply via email to