Content-Type: text/plain;
	charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 14.0 \(3654.120.0.1.13\))
Subject: Re: Password authorization
From: Scott Ribe <scott_ribe@elevated-dev.com>
In-Reply-To: <2D2D1BDD-A6F8-4EAE-B302-2C39DB5CE81B@pendari.org>
Date: Thu, 20 Jan 2022 16:12:03 -0700
Cc: pgsql-admin <pgsql-admin@lists.postgresql.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <CCF10D3D-B013-4736-AAE7-84043553C1BA@elevated-dev.com>
References: 
 <CALfOM6KtjqpO5pYgmpUmDScJMeftv9r509HfYLo2b8gebviL3g@mail.gmail.com>
 <f0455f10526a0463c9e99fc803b6e5ebfd518894.camel@cybertec.at>
 <CALfOM6LJ99-6R+kswd_tF6uQTk-MAzj4HjdCC5FQ5=HMkFbRDQ@mail.gmail.com>
 <2D2D1BDD-A6F8-4EAE-B302-2C39DB5CE81B@pendari.org>
To: Gavan Schneider <list.pg.gavan@pendari.org>
Archived-At: 
 <https://www.postgresql.org/message-id/CCF10D3D-B013-4736-AAE7-84043553C1BA%40elevated-dev.com>
Precedence: bulk

> On Jan 20, 2022, at 3:52 PM, Gavan Schneider =
<list.pg.gavan@pendari.org> wrote:
>=20
> On 21 Jan 2022, at 3:24, Daulat wrote:
>=20
>> Yes, you are right, I am planning for password complexity rules and =
to, force users to change their password.
>>=20
> While you are in the planning stages you may wish to review current =
best practice, e.g., USA National Institute of Standards and Technology.
>=20
> For me the most interesting aspect of the revised standard is how =
forcing password changes and complexity rules often leads to reduced =
security in the real world.
>=20
> Refer:
> https://pages.nist.gov/800-63-3/sp800-63-3.html
> https://auth0.com/blog/dont-pass-on-the-new-nist-password-guidelines/ =
(for a more human readable version :)
>=20
> Regards
>=20
> Gavan Schneider

Slightly off-topic, but I once ran into a system that would not allow =
kk1bsk#$ as a password because it contained a dictionary word.

Still wondering what dictionary they were using...