NIST Recommends New Guidelines For Password Security

NIST Recommends New Guideline
Share It On:

1st October 2024, Kathmandu

The National Institute of Standards and Technology (NIST), the federal agency responsible for setting technology standards for government bodies, standards organizations, and private companies, has proposed eliminating some of the most confusing and counterproductive password policies. Among the key changes: ending mandatory password resets, restricting the use of certain characters, and discontinuing security questions.

NIST Recommends New Guidelines

Creating strong, secure passwords and managing them effectively is one of the most difficult aspects of cybersecurity. This task becomes even more complicated with the password rules enforced by employers, federal agencies, and online service providers. While these rules are meant to improve security, they often have the opposite effect. Despite this, such requirements are still widely imposed.

NIST published the second public draft of its updated Digital Identity Guidelines, known as SP 800-63-4. This 35,000-word document, dense with technical language and bureaucracy, outlines both the mandatory technical requirements and recommended best practices for authenticating digital identities. Any organization that deals with the federal government online must comply with these standards.

A section focusing on passwords introduces several much-needed, sensible changes to traditional policies. One notable update is the removal of the requirement for users to regularly change their passwords. This policy originated decades ago when password security was poorly understood and is outdated. Back then, people often used easily guessed names and dictionary words as passwords.

Currently, services typically require more robust, randomly generated passwords or passphrases. When such strong passwords are in use, forcing users to change them every few months can weaken security. The additional burden leads users to create simpler, easier-to-remember passwords.

Another problematic rule is the requirement to use specific characters, like numbers, special characters, and both uppercase and lowercase letters. When passwords are sufficiently long and random, these character requirements add no real security benefit. Such rules can push users to choose weaker passwords.

NIST’s updated guidelines now state:

  • Verifiers and credential service providers (CSPs) must not impose specific character composition rules (like requiring a mix of character types).
  • Verifiers and CSPs must not require periodic password changes, except in cases where there is evidence of a security compromise.

(For clarity, “verifiers” confirm a user’s identity by validating their credentials, and CSPs are trusted entities that manage the registration and assignment of authenticators.)

In previous versions of the guidelines, the language suggested that organizations “should not” implement certain practices, indicating that they were discouraged but not prohibited. The new “shall not” language clarifies that these practices must be eliminated to meet compliance standards.

The updated guidelines also include several other changes:

  • Passwords must be at least eight characters long, with a recommendation of a minimum of 15 characters.
  • Systems should allow passwords up to 64 characters in length.
  • All printable ASCII characters, including spaces, should be allowed in passwords.
  • Unicode characters should also be permitted, with each character counted as one unit for password length purposes.
  • Password truncation should not be allowed, meaning the full password must be verified.
  • Systems must not offer password hints accessible to unauthorized users.
  • Knowledge-based authentication (like security questions) should no longer be used.

Reconsidering outdated practices

For years, critics have pointed out the flaws and risks of many widely used password policies, yet banks, online services, and government agencies have largely maintained them. If these new NIST guidelines are finalized, they may not be universally binding, but they could serve as a persuasive argument for abandoning outdated practices.

NIST is accepting public comments on the draft guidelines until 7th October. You can comment here: NIST Recommends New Guidelines.


Share It On:

Recent Posts

Citizens Bank 11.11 Deals: Exclusive Discounts on Daraz

Citizens Bank 11.11 Deals: Exclusive Discounts on Daraz

Share It On:5th November 2024, Kathmandu Citizens Bank International Limited signed an agreement with Nepal’s leading online marketplace, Daraz, to

Local Talent Shines in Cybersecurity: Bipu Ojha and Tuan Khuat Win CDU IT CodeFair CTF

Local Talent Shines in Cybersecurity: Bipu Ojha and Tuan Khuat

Share It On:5th November 2024, Kathmandu Bipu Ojha and his teammate Tuan Khuat have emerged as winners in the prestigious

CEDB Hydropower’s Extraordinary General Meeting Concluded: Five Directors Elected

CEDB Hydropower’s Extraordinary General Meeting Concluded: Five Directors Elected

Share It On: 5th November 2024, Kathmandu CEDB Hydropower Development Company Limited has successfully concluded its extraordinary general meeting. CEDB

Government’s Journalist Accident Insurance Program: Apply Now For Your Protection

Government’s Journalist Accident Insurance Program: Apply Now For Your Protection

Share It On: 5th November, Kathmandu The Department of Information and Broadcasting has announced the launch of a new insurance

Nepal Life’s Property Acquisition in Hetauda: A Strategic Move For Growth

Nepal Life’s Property Acquisition in Hetauda: A Strategic Move For

Share It On:5th November, Kathmandu Nepal Life Insurance, a leading life insurance company in Nepal, has recently expanded its footprint

Global IME Dividend Announcement: Key Book Closure Date Revealed

Global IME Dividend Announcement: Key Book Closure Date Revealed

Share It On:5th November 2024, Kathmandu Global IME Bank has good news for its shareholders! The bank has announced a