From: Gavan Schneider <list.pg.gavan@pendari.org>
To: pgsql-admin <pgsql-admin@lists.postgresql.org>
Cc: Laurenz Albe <laurenz.albe@cybertec.at>, Daulat <daulat.dba@gmail.com>
Subject: Re: Password authorization
Date: Fri, 21 Jan 2022 09:52:27 +1100
Message-ID: <2D2D1BDD-A6F8-4EAE-B302-2C39DB5CE81B@pendari.org>
In-Reply-To: 
 <CALfOM6LJ99-6R+kswd_tF6uQTk-MAzj4HjdCC5FQ5=HMkFbRDQ@mail.gmail.com>
References: 
 <CALfOM6KtjqpO5pYgmpUmDScJMeftv9r509HfYLo2b8gebviL3g@mail.gmail.com>
 <f0455f10526a0463c9e99fc803b6e5ebfd518894.camel@cybertec.at>
 <CALfOM6LJ99-6R+kswd_tF6uQTk-MAzj4HjdCC5FQ5=HMkFbRDQ@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Archived-At: 
 <https://www.postgresql.org/message-id/2D2D1BDD-A6F8-4EAE-B302-2C39DB5CE81B%40pendari.org>
Precedence: bulk

On 21 Jan 2022, at 3:24, Daulat wrote:

> Yes, you are right, I am planning for password complexity rules and to,=
 force users to change their password.
>
While you are in the planning stages you may wish to review current best =
practice, e.g., USA National Institute of Standards and Technology.

For me the most interesting aspect of the revised standard is how forcing=
 password changes and complexity rules often leads to reduced security in=
 the real world.

Refer:
https://pages.nist.gov/800-63-3/sp800-63-3.html
https://auth0.com/blog/dont-pass-on-the-new-nist-password-guidelines/ (fo=
r a more human readable version :)

Regards

Gavan Schneider
=E2=80=94=E2=80=94
Gavan Schneider, Sodwalls, NSW, Australia
Explanations exist; they have existed for all time; there is always a wel=
l-known solution to every human problem =E2=80=94 neat, plausible, and wr=
ong.
=E2=80=94 H. L. Mencken, 1920