Amber Clifton

Cybersecurity, human rights, biking, and science aficionado. Also likes puppies. She/they, bionic🦻🏼, delightfully queer/bi.

[BlackRoomSec @blackroomsec]

Please share this far and wide. As far and wide as you can. NIST Password Guidelines for 2024 are in the process of being updated.

This is a HUGE pet-peeve of mine (when vendors in particular are still operating like its 2017 and keep changing passwords every 60 days, STOP DOING THIS, it's outdated and has been shown to put you MORE at risk than less -- NIST explains why it does in this document, meticulously outlining user behavior**) so I'm sharing this in the hopes all of you will pass it along to your bosses.

The Special Publication series governing passwords is SP 800-63 "Digital Identity Guidelines".

The 2024 version is 800-63-4.

Here: https://t.co/oX8YEJHxXg

The companion docs are also on that link. They are 800-63A, 800-63B and 800-63C. These are different documents for different scenarios in play at your org.

The previous update was in2020.

The changes in the 2020 version from the 2017 version were numerous but one of them was that the password verification method should NO LONGER require passwords be changed at specific intervals (i.e. every 60 days) but in the following circumstances instead:

1. After a breach/compromise
2. User request

2024 repeats this and adds a bunch more guidlines but here is a screenshot of page 13 of the new 800-63-4 (note the # 4 after it) which outlines how your systems should now and moving forward, be handling passwords.

This goes for Active Directory, too. All your systems which have passwords should align with these guidelines provided there isn't another standard or framework you must adhere to which overrules this.

Most frameworks, however, have moved away from arbitrary password resets and complexity rules.

**We cybersec researchers and hackers use wordlists from breaches in a variety of different ways. Hackers use them in tooling to crack passwords whereas researchers use breach dumps to see the kinds of passwords users are creating and the psychology behind them.

Using complexity rules gets you the user psychology of:

Password1
Password2
and so on

Use phrasing instead and allow for spaces, which is important. Humans type phrases with spaces. They also mention phish-resistant methods and most vendors are on-board with MS going to be turning off all Legacy Auth next month, across all free accounts and tenancies.

I'm so excited for the new changes!

Ok I'm off my soapbox.

Share the love! Thank you!

[Four Seasons Total Landscaping @TotalSeasons]

We’d like to announce that while we are not a hotel, we are a concept of a hotel.

[Joshin and Jokien @joshcarlosjosh]

when I say "I've got that dog in me" this is what I mean

[Dr. Lucky Tran @luckytran]

According to the latest CDC COVID-19 wastewater data, we are currently in the second-biggest surge of the pandemic.

It will peak in the next week, with ~2 million infections per day. During this surge, ~100 million people total (~1 in 3 people in the US) will likely get COVID.

[Amber Clifton @AmberCClifton]

@julianakilrose I got a Flo mask that stays on well even when I’m doing partner acrobatics (circus stuff) and doesn’t push against my mouth, so is actually pretty comfortable. I wear it for regular gym stuff and have even worn it outdoor biking to help with smog. It was pricey, but def worth it.

[Amber Clifton @AmberCClifton]

Teenage Mutant Ninja Turtles 2: Secret of the Ooze

[Dan Pantelo @danpantelo]

So there’s literal green sludge bubbling up from the ground next to World Trade Center right now

[Amber Clifton @AmberCClifton]

My spouse is at a hockey game for my favorite team (w/o me) and msging me questions about the number of ppl on the “field” and keeping track of “the ball”

This scenario was not covered in our vows.

[Amber Clifton @AmberCClifton]

I am "oh, these are some good stamps" years old.

[Rachel Tobac @RachelTobac]

How do we get Taylor Swift to talk about the risks of password reuse lmao

[Amber Clifton @AmberCClifton]

@wolfperson1 Also a perfect little angel baby

[Amber Clifton @AmberCClifton]

I tell our cat she is a perfect little angel baby an awful lot for a goblin who would lick the butter off my toast given half a chance.

[Cary Hendricks (@figⁿjam) 🏴󠁧󠁢󠁳󠁣󠁴󠁿 @fignjam]

A pentester walks into a bar.
Orders a beer.
Orders 0 beers.
Orders 999999 beers.
Orders a lizard.
Orders -1 beers.
Orders a....

[Amber Clifton @AmberCClifton]

@vvictorman_uel I have fine hair and weak curls (2a-c mix) that deflate to frizz. As I Am leave-in conditioner is great, as is using a very soft tshirt as a hair towel. My reg conditioner changed formulas, so I no longer rec it. Your hair can handle heavier products than mine. Good luck!

[hk @hassankhan]

Removing the block option would violate TOS for both the App Store and Play Store

[Amber Clifton @AmberCClifton]

@binaryhansolo @probablypranjal Squinting at my code makes it run faster

[Muting/Blocking = Self Care @QueeringPsych]

1) A lot of people in the US aren’t aware that the way we’ve been taught to home test for COVID is outdated & that’s probably 1 reason why home tests are “negative” with positive symptoms

The image doesn’t have alt text so see below for simplified paraphrase:

[Amber Clifton @AmberCClifton]

I think this is actually how the T works.

[PolyMars @PolyMarsYT]

here's a cursed gaming fact you didn't need to know about

in fallout 3, they couldn't make trains move, but they had walking npcs

so, the devs turned the train into a hat. there's literally a dude walking around underground with a train hat on, pretending to be public transport

[Amber Clifton @AmberCClifton]

I’m so excited about the @sec_defcon cold calls

[Amber Clifton @AmberCClifton]

Shout out to @CryptoVillage for having these babies stashed around. Such a small thing, such a big impact on air quality. #DEFCON31

[Amber Clifton @AmberCClifton]

Sup, defcon nerds?