User-Centered Security

Strong password policies have long been a topic of debate in the information security community, with advocates of password policies that encourage strong passwords while still maintaining a good user experience gaining traction recently. The latest NIST guidance on memorized secrets adopts a user-centric approach, overturning previous requirements that levied a more onerous burden on users like mandatory complexity measures and mandatory recurring password changes. These password policies were intended to reduce the likelihood of attackers successfully guessing user passwords and mitigate the impact of data breaches by limiting the duration attackers could re-use compromised credentials. However, both of these concerns are now addressed via other means: rate-limiting password attempts obviates the need for highly complex memorized secrets, and blacklisting passwords found in data breaches mitigates the impact of credential-stuffing attacks. The latter technique is particularly imp...