pg.ddx.io  pgsql-admin@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Gavan Schneider <list.pg.gavan@pendari.org>
To: pgsql-admin <pgsql-admin@lists.postgresql.org>
Cc: Laurenz Albe <laurenz.albe@cybertec.at>
Cc: Daulat <daulat.dba@gmail.com>
Subject: Re: Password authorization
Date: Fri, 21 Jan 2022 09:52:27 +1100
Message-ID: <2D2D1BDD-A6F8-4EAE-B302-2C39DB5CE81B@pendari.org> (raw)
In-Reply-To: <CALfOM6LJ99-6R+kswd_tF6uQTk-MAzj4HjdCC5FQ5=HMkFbRDQ@mail.gmail.com>
References: <CALfOM6KtjqpO5pYgmpUmDScJMeftv9r509HfYLo2b8gebviL3g@mail.gmail.com>
	<f0455f10526a0463c9e99fc803b6e5ebfd518894.camel@cybertec.at>
	<CALfOM6LJ99-6R+kswd_tF6uQTk-MAzj4HjdCC5FQ5=HMkFbRDQ@mail.gmail.com>

On 21 Jan 2022, at 3:24, Daulat wrote:

> Yes, you are right, I am planning for password complexity rules and to, force users to change their password.
>
While you are in the planning stages you may wish to review current best practice, e.g., USA National Institute of Standards and Technology.

For me the most interesting aspect of the revised standard is how forcing password changes and complexity rules often leads to reduced security in the real world.

Refer:
https://pages.nist.gov/800-63-3/sp800-63-3.html
https://auth0.com/blog/dont-pass-on-the-new-nist-password-guidelines/ (for a more human readable version :)

Regards

Gavan Schneider
——
Gavan Schneider, Sodwalls, NSW, Australia
Explanations exist; they have existed for all time; there is always a well-known solution to every human problem — neat, plausible, and wrong.
— H. L. Mencken, 1920





view thread (13+ messages)  latest in thread

Message-ID: <2D2D1BDD-A6F8-4EAE-B302-2C39DB5CE81B@pendari.org>
Permalink:  ../2D2D1BDD-A6F8-4EAE-B302-2C39DB5CE81B@pendari.org/
Also on:    postgresql.org/message-id/2D2D1BDD-A6F8-4EAE-B302-2C39DB5CE81B@pendari.org

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-admin@postgresql.org
  Cc: list.pg.gavan@pendari.org, pgsql-admin@lists.postgresql.org, laurenz.albe@cybertec.at, daulat.dba@gmail.com
  Subject: Re: Password authorization
  In-Reply-To: <2D2D1BDD-A6F8-4EAE-B302-2C39DB5CE81B@pendari.org>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox