ʞɔıɹʇɐԀ sɐɯoɥ⊥

Infosec dweeb, social-political skeptic, & cat video enthusiast

[BlackRoomSec @blackroomsec]

Please share this far and wide. As far and wide as you can. NIST Password Guidelines for 2024 are in the process of being updated.

This is a HUGE pet-peeve of mine (when vendors in particular are still operating like its 2017 and keep changing passwords every 60 days, STOP DOING THIS, it's outdated and has been shown to put you MORE at risk than less -- NIST explains why it does in this document, meticulously outlining user behavior**) so I'm sharing this in the hopes all of you will pass it along to your bosses.

The Special Publication series governing passwords is SP 800-63 "Digital Identity Guidelines".

The 2024 version is 800-63-4.

Here: https://t.co/oX8YEJHxXg

The companion docs are also on that link. They are 800-63A, 800-63B and 800-63C. These are different documents for different scenarios in play at your org.

The previous update was in2020.

The changes in the 2020 version from the 2017 version were numerous but one of them was that the password verification method should NO LONGER require passwords be changed at specific intervals (i.e. every 60 days) but in the following circumstances instead:

1. After a breach/compromise
2. User request

2024 repeats this and adds a bunch more guidlines but here is a screenshot of page 13 of the new 800-63-4 (note the # 4 after it) which outlines how your systems should now and moving forward, be handling passwords.

This goes for Active Directory, too. All your systems which have passwords should align with these guidelines provided there isn't another standard or framework you must adhere to which overrules this.

Most frameworks, however, have moved away from arbitrary password resets and complexity rules.

**We cybersec researchers and hackers use wordlists from breaches in a variety of different ways. Hackers use them in tooling to crack passwords whereas researchers use breach dumps to see the kinds of passwords users are creating and the psychology behind them.

Using complexity rules gets you the user psychology of:

Password1
Password2
and so on

Use phrasing instead and allow for spaces, which is important. Humans type phrases with spaces. They also mention phish-resistant methods and most vendors are on-board with MS going to be turning off all Legacy Auth next month, across all free accounts and tenancies.

I'm so excited for the new changes!

Ok I'm off my soapbox.

Share the love! Thank you!

[Brückenbummlerin | Sommerpausenpsychose @A661ultra]

corsica turning the blindfold into a headband after their revolution and independence was honestly one of the hardest going flag changes of all time

[rootsecdev @rootsecdev]

Free training 🚨

Microsoft Office Offensive Tradecraft for Red Teamers

https://t.co/WraNxcx3XZ

[ʞɔıɹʇɐԀ sɐɯoɥ⊥ @ANarrowView]

@LitMoose Cat twitter > InfoSec twitter

[ʞɔıɹʇɐԀ sɐɯoɥ⊥ @ANarrowView]

@george_513 @BrettCallow Unless the feds captured only a portion of the Alphv group and the remaining portion is trying to stand back up operations.

[ʞɔıɹʇɐԀ sɐɯoɥ⊥ @ANarrowView]

"We found a BlackCat ransom note but its encrypted by the Cuba ransomware"

Things your client doesn't want to hear on an update call.

[Corey Quinn @QuinnyPig]

Today's thread is about something I'm rather experienced with...

How to Get Fired With Both Grace and Aplomb

[Florian Roth ⚡️ @cyb3rops]

If you really want people to click on your phishing link, make it a small „unsubscribe“ button at the end of an subtly annoying newsletter

[ʞɔıɹʇɐԀ sɐɯoɥ⊥ @ANarrowView]

@SwiftOnSecurity It also can write or enhance a regex, great for rex commands or parsing logs during initial ingestion.

[ʞɔıɹʇɐԀ sɐɯoɥ⊥ @ANarrowView]

Getting very excited to go to @RVAsec in a couple of weeks!!

[ʞɔıɹʇɐԀ sɐɯoɥ⊥ @ANarrowView]

@T0P_Cyber, very much appreciate your Hawk forensics tool, its a great contribution to the InfoSec community. QQ - is there any way to use -StartDate or -EndDate inline when initiating the script?

[follow @bencollins on bluesky @oneunderscore__]

|-----------|
| SITE'S |
| BROKEN, |
| POST |
| ASCII |
| ART |
|-----------|
(\__/) ||
(•ㅅ•) ||
/ 　 づ

[ʞɔıɹʇɐԀ sɐɯoɥ⊥ @ANarrowView]

This is the greatest auto-reply I've ever received in my life. #WorkLifeBalance

[ʞɔıɹʇɐԀ sɐɯoɥ⊥ @ANarrowView]

Me: suffers from imposter syndrome

Also me: continuously works in a role that can be called as an expert witness

[ʞɔıɹʇɐԀ sɐɯoɥ⊥ @ANarrowView]

@uuallan Another method is to start preheating your oven, turn it off after only 5 mins or so, then proof the bread in there overnight. The oven _should_ retain enough heat.

[ʞɔıɹʇɐԀ sɐɯoɥ⊥ @ANarrowView]

Hey @tastebudspod, show suggestion.. ballpark snacks. Cracker jacks vs peanuts vs cotton candy vs whatev, think it’s a good premise

[ʞɔıɹʇɐԀ sɐɯoɥ⊥ @ANarrowView]

Can @OpenAI's ChatGPT be used as a force multiplier for #cybersecurity teams? I think so! Check out some examples I created in my newest blog post https://t.co/BwIVgD81MH

[Leonardo Braga 🇨🇦🇧🇷 @LeonardoBraga]

Super useful feature! If you're working on Windows and don't have PowerToys installed yet, you're missing out!

[ʞɔıɹʇɐԀ sɐɯoɥ⊥ @ANarrowView]

@rogue_corq Walmart @KevinHart4real