This message was deleted.

sounds like a dream world

Oh, I'm - I mean, my friend - isn't complaining. Just thought it was a weird policy to start in 2021.

NIST actually mentioned aggressive password expiration policies result in a weaker posture due to reuse (adding 1..2...3..4..etc), reusing passwords elsewhere, or writing them down in a document in 2020.

That's what I assumed would happen. I can't speak for what InfoSec does, though.

here is a blog post from auth0 on it https://auth0.com/blog/dont-pass-on-the-new-nist-password-guidelines/ from NIST SP800-63B-3

Now that's interesting.

We no longer enforce password changes or complexity requirements due to the new NIST advice. We enforce long passwords and check hashes against a compromised password database. Basically this: https://xkcd.com/936/

We moved to 1 year passwords for general accounts last year, i think. May have been 2019 - its all a blur. Along with a filter to stop easily guessable passwords. Much rejoicing was had.

That’s exactly what our new policy is - 365 day expiration, longer passwords, and hashes checked routinely.