pg.ddx.io  pgsql-admin@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Scott Ribe <scott_ribe@elevated-dev.com>
To: Gavan Schneider <list.pg.gavan@pendari.org>
Cc: pgsql-admin <pgsql-admin@lists.postgresql.org>
Subject: Re: Password authorization
Date: Thu, 20 Jan 2022 16:12:03 -0700
Message-ID: <CCF10D3D-B013-4736-AAE7-84043553C1BA@elevated-dev.com> (raw)
In-Reply-To: <2D2D1BDD-A6F8-4EAE-B302-2C39DB5CE81B@pendari.org>
References: <CALfOM6KtjqpO5pYgmpUmDScJMeftv9r509HfYLo2b8gebviL3g@mail.gmail.com>
	<f0455f10526a0463c9e99fc803b6e5ebfd518894.camel@cybertec.at>
	<CALfOM6LJ99-6R+kswd_tF6uQTk-MAzj4HjdCC5FQ5=HMkFbRDQ@mail.gmail.com>
	<2D2D1BDD-A6F8-4EAE-B302-2C39DB5CE81B@pendari.org>

> On Jan 20, 2022, at 3:52 PM, Gavan Schneider <list.pg.gavan@pendari.org> wrote:
> 
> On 21 Jan 2022, at 3:24, Daulat wrote:
> 
>> Yes, you are right, I am planning for password complexity rules and to, force users to change their password.
>> 
> While you are in the planning stages you may wish to review current best practice, e.g., USA National Institute of Standards and Technology.
> 
> For me the most interesting aspect of the revised standard is how forcing password changes and complexity rules often leads to reduced security in the real world.
> 
> Refer:
> https://pages.nist.gov/800-63-3/sp800-63-3.html
> https://auth0.com/blog/dont-pass-on-the-new-nist-password-guidelines/ (for a more human readable version :)
> 
> Regards
> 
> Gavan Schneider

Slightly off-topic, but I once ran into a system that would not allow kk1bsk#$ as a password because it contained a dictionary word.

Still wondering what dictionary they were using...







view thread (13+ messages)  latest in thread

Message-ID: <CCF10D3D-B013-4736-AAE7-84043553C1BA@elevated-dev.com>
Permalink:  ../CCF10D3D-B013-4736-AAE7-84043553C1BA@elevated-dev.com/
Also on:    postgresql.org/message-id/CCF10D3D-B013-4736-AAE7-84043553C1BA@elevated-dev.com

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-admin@postgresql.org
  Cc: scott_ribe@elevated-dev.com, list.pg.gavan@pendari.org, pgsql-admin@lists.postgresql.org
  Subject: Re: Password authorization
  In-Reply-To: <CCF10D3D-B013-4736-AAE7-84043553C1BA@elevated-dev.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox