Proposed guidelines aim to inject badly needed common sense into password hygiene.

Here is the text of the NIST sp800-63b Digital Identity Guidelines.

  • jj4211@lemmy.worldEnglish
    0·
    11 hours ago

    Meanwhile, my company has systems insisting on expiring ssh keys after 90 days…

    • dan@upvote.auEnglish
      0·
      9 hours ago

      I’m surprised they’d expire the SSH keys rather than just requiring the password for the key to be rotated. I guess it’s not too bad if the key itself is automatically rotated.

      It would be more secure to have SSH keys that are stored on Yubikeys, though. Get the Yubikeys that check fingerprints (Yubikey Bio) if you’re extra paranoid.

    • TBi@lemmy.worldEnglish
      0·
      10 hours ago

      My company blocked ssh keys in favour of password + 2FA. Honestly I don’t mind the 2FA since we use yubikeys, but wouldn’t ssh key + 2FA be better?