NIST Recommends New Guidelines For Password Security

NIST Recommends New Guideline
Share It On:

1st October 2024, Kathmandu

The National Institute of Standards and Technology (NIST), the federal agency responsible for setting technology standards for government bodies, standards organizations, and private companies, has proposed eliminating some of the most confusing and counterproductive password policies. Among the key changes: ending mandatory password resets, restricting the use of certain characters, and discontinuing security questions.

NIST Recommends New Guidelines

Creating strong, secure passwords and managing them effectively is one of the most difficult aspects of cybersecurity. This task becomes even more complicated with the password rules enforced by employers, federal agencies, and online service providers. While these rules are meant to improve security, they often have the opposite effect. Despite this, such requirements are still widely imposed.

NIST published the second public draft of its updated Digital Identity Guidelines, known as SP 800-63-4. This 35,000-word document, dense with technical language and bureaucracy, outlines both the mandatory technical requirements and recommended best practices for authenticating digital identities. Any organization that deals with the federal government online must comply with these standards.

A section focusing on passwords introduces several much-needed, sensible changes to traditional policies. One notable update is the removal of the requirement for users to regularly change their passwords. This policy originated decades ago when password security was poorly understood and is outdated. Back then, people often used easily guessed names and dictionary words as passwords.

Currently, services typically require more robust, randomly generated passwords or passphrases. When such strong passwords are in use, forcing users to change them every few months can weaken security. The additional burden leads users to create simpler, easier-to-remember passwords.

Another problematic rule is the requirement to use specific characters, like numbers, special characters, and both uppercase and lowercase letters. When passwords are sufficiently long and random, these character requirements add no real security benefit. Such rules can push users to choose weaker passwords.

NIST’s updated guidelines now state:

  • Verifiers and credential service providers (CSPs) must not impose specific character composition rules (like requiring a mix of character types).
  • Verifiers and CSPs must not require periodic password changes, except in cases where there is evidence of a security compromise.

(For clarity, “verifiers” confirm a user’s identity by validating their credentials, and CSPs are trusted entities that manage the registration and assignment of authenticators.)

In previous versions of the guidelines, the language suggested that organizations “should not” implement certain practices, indicating that they were discouraged but not prohibited. The new “shall not” language clarifies that these practices must be eliminated to meet compliance standards.

The updated guidelines also include several other changes:

  • Passwords must be at least eight characters long, with a recommendation of a minimum of 15 characters.
  • Systems should allow passwords up to 64 characters in length.
  • All printable ASCII characters, including spaces, should be allowed in passwords.
  • Unicode characters should also be permitted, with each character counted as one unit for password length purposes.
  • Password truncation should not be allowed, meaning the full password must be verified.
  • Systems must not offer password hints accessible to unauthorized users.
  • Knowledge-based authentication (like security questions) should no longer be used.

Reconsidering outdated practices

For years, critics have pointed out the flaws and risks of many widely used password policies, yet banks, online services, and government agencies have largely maintained them. If these new NIST guidelines are finalized, they may not be universally binding, but they could serve as a persuasive argument for abandoning outdated practices.

NIST is accepting public comments on the draft guidelines until 7th October. You can comment here: NIST Recommends New Guidelines.


Share It On:

Recent Posts

Liberty Energy Rights Shares Offering: Eligibility, Application Process, and Future Plans

Liberty Energy Rights Shares Offering: Eligibility, Application Process, and Future

Share It On:22nd November 2024, Kathmandu Liberty Energy Company Limited is gearing up to issue rights shares starting December 1,

Asha Laghubitta’s 8th AGM 2024: Key Decisions and Future Plans

Asha Laghubitta’s 8th AGM 2024: Key Decisions and Future Plans

Share It On:22nd November 2024, Kathmandu Asha Laghubitta Bittiya Sanstha is holding its 8th Annual General Meeting (AGM) today, November

6th Asian Population Conference 2024 in Nepal: Advancing Sexual and Reproductive Health Policies

6th Asian Population Conference 2024 in Nepal: Advancing Sexual and

Share It On: 21st November, Kathmandu Nepal is set to host the 6th Asian Population Conference from November 27 to

Kumari Bank Promoter Share Sale: Eligibility, Application Process, and Price

Kumari Bank Promoter Share Sale: Eligibility, Application Process, and Price

Share It On:21st November, Kathmandu Kumari Bank Limited has officially declared its intention to sell a substantial number of promoter

Up to NPR 150 Cashback on Nepal Telecom and Ncell Services with Namaste Pay

Up to NPR 150 Cashback on Nepal Telecom and Ncell

Share It On:21st November, Kathmandu Namaste Pay has unveiled an exciting new campaign to reward its users with cashback on

Ncell introduces innovative feature, enabling customers to convert voice to data or data to voice services

Ncell introduces innovative feature, enabling customers to convert voice to

Share It On:21st November, Kathmandu Ncell customers can enjoy an innovative feature that allows them to convert or exchange remaining