{"id":5483,"date":"2024-09-26T07:30:38","date_gmt":"2024-09-26T12:30:38","guid":{"rendered":"https:\/\/www.darkreading.com\/identity-access-management-security\/nist-drops-password-complexity-mandatory-reset-rules"},"modified":"2024-09-26T07:30:38","modified_gmt":"2024-09-26T12:30:38","slug":"nist-drops-password-complexity-mandatory-reset-rules","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/09\/26\/nist-drops-password-complexity-mandatory-reset-rules\/","title":{"rendered":"NIST Drops Password Complexity, Mandatory Reset Rules"},"content":{"rendered":"
<\/a><\/div>\n
<\/div>\n

The National Institute of Standards and Technology (NIST) is no longer recommending using a mixture of character types in passwords or regularly changing passwords as part of best practices for managing passwords.<\/span><\/p>\n

NIST’s second public draft version of its password guidelines (<\/span>SP 800-63-4<\/a><\/span>) outlines technical requirements as well as recommended best practices for password management and authentication. The latest guidelines suggest that credential service providers (CSP) stop requiring users set passwords that use specific types or characters and stop mandating periodic password changes (commonly every 60 or 90 days). Also, CSPs should stop using knowledge-based authentication or security questions when selecting passwords.<\/span><\/p>\n

Other recommendations include:<\/span><\/p>\n

\n