This has been in their guidance since at least 2017.

"Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets. Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator"

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.S...

Also worth pointing out that NIST doesn't set policy, so unfortunately this doesn't directly "forbid" anything, though many other policies reference 800-63.

FINALLY. Good God, how annoying those website signups with "a good password must use a, b and c" are... It seems a lot of site devs know shit about what a good password is.

Also forbids 'security questions' e.g. "What is your mother's maiden name?"

Great, NIST put out objectively bad password guidance for a couple of decades and then decides to change it to a more sane solution. Too bad a GIANT swath of password-protected software was built on their prior incompetent guidance and will take decades for all of that software to change... if they change at all.

> 9 Verifiers SHALL verify the entire submitted password...

Is this "don't microwave your hamster"-requirement a result of the bcrypt trouble [1] or how comes?

[1] https://security.stackexchange.com/questions/39849/does-bcry...

also raises the suggested max password length to a much more reasonable 64 (many sites have a max of 20 that makes passphrases impossible)

Little story:

My wife's bank was using a numeric id as the login until last month. They had token based and then app based codes instead of passwords, which was decent.

This month they forced her to pick an user name instead of the numeric code to login. They required her to have at least one capital letter and a number. In the user.

According to Gemini it's the 8th largest European bank :)

Finally! A best practice that makes sense! Now let us see the password as we "type" on rinky dink cell phone virtual keyboards!

So the argument of whether this increases or decreases entropy goes both ways:

1. Requiring certain characters is a limit on which characters are selected. An attacker now knows to look for at least one digit, upper case char, and one of 10 special chars. This is a smaller selection of characters than the whole of all characters that were available before, so it decreases entropy.

2. Most users choose weak simple passwords with low entropy. Requiring users to use some characters that they wouldn't otherwise increases the entropy as it increases the selection of characters in the password.

I actually don't believe 2, as most users will just start with an upper case char and end with 1!, so the entropy will still decrease for most users, as they will choose easily guessable placements for these required chars.

I'm still waiting for NIST to deprecate plain-text* passwords in favor of PAKE, and W3C to come up with a mechanism for that.

*) plain-text here means any and all methods that give the attacker access to the original password, including modifying client-side JS.

Thank God.

I’ve been noticing this downward spiral for more than a decade now. It’s becoming unmanageable to use authentication.

It’s MFA, passwords and passkeys in multiple forms. I have to reach several times a day for the phone to get yet another MFA from the Authenticator or SMS to login the same site I’ve used yesterday. Constant nagging for “security“ from everywhere, and on top of these, these unproductive password changes requests described in the article.

I been thinking about it the last months, and we really need a paradigm shift when it comes to authentication. I’m not knowledgeable enough to know what, but I can see the problem pilling up in front of my own eyes.

The requirements could be even more clearer

* max 64 chars “should” requirement? vs. no truncation?

* what about pin-codes?

* the password process is still very much a hot mess, standardize registration, IIA, updating, cancellation

* protection of passwords at-rest, salt your passwords

Direct link to source https://pages.nist.gov/800-63-4/sp800-63b.html#passwordver

"Your password validation rule must not contain a 'your password must contain a'"?

Can't we just leave passwords behind once and for all...

That enables passphrases! accurate donkey charger glue

Too bad it won't get adopted by existing systems. I know huge companies still doing mandatory frequent password changes despite us telling them it goes against NIST for years.