Adrian Watkins

Photographer of Faces and Places This account is basically inactive now 🦋

[Adrian Watkins @asrw1]

@abidaker I figured 30 was (a couple years ago 🤭)
Hope it’s a happy day for ya regardless Mate :)

[Doktor Funk @doktor_DeFi]

I'd like to take a moment to give thanks to the incredible @abidaker. Abi did this commission of Vilnius, Lithuania for my wife, which is where we spent our honeymoon. My wife loved it, and Abi is such a tremendous artist. I highly encourage you to support her. ❤️

[Adrian Watkins @asrw1]

@alexlindsay @JoelEsler @cspan I’ll give you the background pre show EH

[Adrian Watkins @asrw1]

@abidaker Happy to :)

[Adrian Watkins @asrw1]

@photojoseph #3 :)

[Adrian Watkins @asrw1]

@GailCCallaghan @abidaker @OurNewHomecoach +1 I can pop some pix up for ya Abi :)

[Adrian Watkins @asrw1]

@brettroberts Psilocybin 🤭

[Adrian Watkins @asrw1]

@abidaker We need ya on the show with that walk thru :)🤯😍

[alexlindsay @alexlindsay]

Required watching...
https://t.co/c3paBzLoj4

[Adrian Watkins @asrw1]

@NetballNZ

[Cathrine Tuivaiti @CatTuivaiti]

@SilverFernsNZ let Sophie sit on the bench plz lol

[BlackRoomSec @blackroomsec]

Please share this far and wide. As far and wide as you can. NIST Password Guidelines for 2024 are in the process of being updated.

This is a HUGE pet-peeve of mine (when vendors in particular are still operating like its 2017 and keep changing passwords every 60 days, STOP DOING THIS, it's outdated and has been shown to put you MORE at risk than less -- NIST explains why it does in this document, meticulously outlining user behavior**) so I'm sharing this in the hopes all of you will pass it along to your bosses.

The Special Publication series governing passwords is SP 800-63 "Digital Identity Guidelines".

The 2024 version is 800-63-4.

Here: https://t.co/oX8YEJHxXg

The companion docs are also on that link. They are 800-63A, 800-63B and 800-63C. These are different documents for different scenarios in play at your org.

The previous update was in2020.

The changes in the 2020 version from the 2017 version were numerous but one of them was that the password verification method should NO LONGER require passwords be changed at specific intervals (i.e. every 60 days) but in the following circumstances instead:

1. After a breach/compromise
2. User request

2024 repeats this and adds a bunch more guidlines but here is a screenshot of page 13 of the new 800-63-4 (note the # 4 after it) which outlines how your systems should now and moving forward, be handling passwords.

This goes for Active Directory, too. All your systems which have passwords should align with these guidelines provided there isn't another standard or framework you must adhere to which overrules this.

Most frameworks, however, have moved away from arbitrary password resets and complexity rules.

**We cybersec researchers and hackers use wordlists from breaches in a variety of different ways. Hackers use them in tooling to crack passwords whereas researchers use breach dumps to see the kinds of passwords users are creating and the psychology behind them.

Using complexity rules gets you the user psychology of:

Password1
Password2
and so on

Use phrasing instead and allow for spaces, which is important. Humans type phrases with spaces. They also mention phish-resistant methods and most vendors are on-board with MS going to be turning off all Legacy Auth next month, across all free accounts and tenancies.

I'm so excited for the new changes!

Ok I'm off my soapbox.

Share the love! Thank you!

[abi @abidaker]

please RT, I need to sell some of these drawings, they are extremely well priced

[Jim Gaffigan @JimGaffigan]

I post this every year on 9-11. No words. #remebering911

[Jeff Cable @jcable12]

Next week I will be on Zoom showing images and telling stories from the Summer Olympics in Paris. you can register (and it is free) here: https://t.co/IiwKTxPrIy

[Adrian Watkins @asrw1]

@brettroberts And the horse you rode in on 🙃

[Adrian Watkins @asrw1]

@ZeroDistraction Coz it’s not x ;)

[Adrian Watkins @asrw1]

@GlenBMulcahy Gotta be getting to the last straw but so many not on BlueSky yet 🤷🏻‍♂️

[Adrian Watkins @asrw1]

@juhasaarinen