InfoSecBulletin Cybersecurity for mankind
The National Institute of Standards and Technology (NIST) has issued new guidelines for password security, representing a major change from standard practices.
These new recommendations, outlined in NIST Special Publication 800-63B, aim to enhance cybersecurity while improving user experience.
FBI investigating cyberattack at Oracle, Bloomberg News reports
OpenAI Offering $100K Bounties for Critical Vulns
Splunk Alert User RCE and Data Leak Vulns
CIRT alert Situational Awareness for Eid Holidays
Cyberattack on Malaysian airports: PM rejected $10 million ransom
Micropatches released for Windows zero-day leaking NTLM hashes
VMware Patches Authentication Bypass Flaw in Windows Tool
IngressNightmare
Over 40% of cloud environments are vulnerable to RCE
(CVE-2025-29927)
Urgently Patch Your Next.js for Authorization Bypass
Oracle refutes breach after hacker claims 6 million data theft
NIST has changed its approach to password complexity. Instead of requiring a mix of uppercase and lowercase letters, numbers, and special characters, they now emphasize the importance of password length for strength.
“Longer passwords are generally more secure and easier for users to remember,” said Dr. Paul Turner, a cybersecurity expert at NIST. “We’re moving away from complex rules that often lead to predictable patterns and towards encouraging unique, lengthy passphrases.”
NIST now advises a minimum password length of 8 characters, emphasizing the importance of even longer passwords for enhanced security. Organizations should enable passwords of up to at least 64 characters to support the use of robust passphrases.
Another significant change is the removal of mandatory password changes. NIST believes that frequent resets can result in weaker passwords, as users often make small, predictable adjustments. Passwords should be changed only when there is evidence of a security breach.
“Forcing users to change passwords regularly doesn’t improve security and can actually be counterproductive,” Turner explained. “It’s more effective to monitor for compromised credentials and require changes only when necessary.”
The new guidelines highlight the critical need to verify passwords against lists of frequently used or compromised passwords. NIST advises organizations to keep a current blocklist of weak passwords, thereby ensuring that users are prohibited from selecting any password from this list.
NIST recommends against using password hints or knowledge-based authentication questions because they can be easily guessed or discovered through social engineering.
NIST advocates for the use of salted hashing to store passwords, emphasizing the importance of a work factor that renders offline attacks prohibitively expensive to execute. This method provides robust protection for stored passwords, even in the event of a database breach.
Other requirements to be followed:
*Verifiers and CSPs SHALL require passwords to be a minimum of eight characters in length and SHOULD require * passwords to be a minimum of 15 characters in length.
* Verifiers and CSPs SHOULD permit a maximum password length of at least 64 characters.
* Verifiers and CSPs SHOULD accept all printing ASCII [RFC20] characters and the space character in passwords.
* Verifiers and CSPs SHOULD accept Unicode [ISO/ISC 10646] characters in passwords. Each Unicode code point * SHALL be counted as a single character when evaluating password length.
* Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords.
* Verifiers and CSPs SHALL NOT require users to change passwords periodically. However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.
* Verifiers and CSPs SHALL NOT permit the subscriber to store a hint that is accessible to an unauthenticated claimant.
* Verifiers and CSPs SHALL NOT prompt subscribers to use knowledge-based authentication (KBA) (e.g., “What was the name of your first pet?”) or security questions when choosing passwords.
* Verifiers SHALL verify the entire submitted password (i.e., not truncate it).
* The guidelines also stress the importance of multi-factor authentication (MFA) as an additional layer of security. * While not a direct password requirement, NIST strongly encourages the use of MFA wherever possible.
These new recommendations have been well-received by many in the cybersecurity community. “NIST’s updated guidelines align with what security researchers have been advocating for years,” said Sarah Chen, CTO of SecurePass, a password management company. “They strike a good balance between security and usability.”
Organizations are adopting new guidelines for password policies, leading to changes across different platforms. Although it may take time for all systems to adjust, experts believe these updates will enhance password security over time.
NIST states that these guidelines are intended for all organizations focused on cybersecurity, not just federal agencies.
