Proposed guidelines aim to inject badly needed common sense into password hygiene.

Here is the text of the NIST sp800-63b Digital Identity Guidelines.

  • jj4211@lemmy.worldEnglish
    17·
    2 months ago

    Meanwhile, my company has systems insisting on expiring ssh keys after 90 days…

    • TBi@lemmy.worldEnglish
      5·
      2 months ago

      My company blocked ssh keys in favour of password + 2FA. Honestly I don’t mind the 2FA since we use yubikeys, but wouldn’t ssh key + 2FA be better?

      • jj4211@lemmy.worldEnglish
        1·
        2 months ago

        All well and good when ssh activity is anchored in a human doing interactive stuff, but not as helpful when there’s a lot of headless automation that has to get from point a to point b.

      • jj4211@lemmy.worldEnglish
        2·
        2 months ago

        You are going to give them ideas…

        Ironically, reinstall the whole system, make sure to add some CrowdStrike, SolarWinds, and Ivanti for security and management though…