Dries007

Minecraft modder & Electronics enthusiast. Also good at procrastinating

[Lane || Boot.dev @wagslane]

https://t.co/VdFYvAm8LE

[BlackRoomSec @blackroomsec]

Please share this far and wide. As far and wide as you can. NIST Password Guidelines for 2024 are in the process of being updated.

This is a HUGE pet-peeve of mine (when vendors in particular are still operating like its 2017 and keep changing passwords every 60 days, STOP DOING THIS, it's outdated and has been shown to put you MORE at risk than less -- NIST explains why it does in this document, meticulously outlining user behavior**) so I'm sharing this in the hopes all of you will pass it along to your bosses.

The Special Publication series governing passwords is SP 800-63 "Digital Identity Guidelines".

The 2024 version is 800-63-4.

Here: https://t.co/oX8YEJHxXg

The companion docs are also on that link. They are 800-63A, 800-63B and 800-63C. These are different documents for different scenarios in play at your org.

The previous update was in2020.

The changes in the 2020 version from the 2017 version were numerous but one of them was that the password verification method should NO LONGER require passwords be changed at specific intervals (i.e. every 60 days) but in the following circumstances instead:

1. After a breach/compromise
2. User request

2024 repeats this and adds a bunch more guidlines but here is a screenshot of page 13 of the new 800-63-4 (note the # 4 after it) which outlines how your systems should now and moving forward, be handling passwords.

This goes for Active Directory, too. All your systems which have passwords should align with these guidelines provided there isn't another standard or framework you must adhere to which overrules this.

Most frameworks, however, have moved away from arbitrary password resets and complexity rules.

**We cybersec researchers and hackers use wordlists from breaches in a variety of different ways. Hackers use them in tooling to crack passwords whereas researchers use breach dumps to see the kinds of passwords users are creating and the psychology behind them.

Using complexity rules gets you the user psychology of:

Password1
Password2
and so on

Use phrasing instead and allow for spaces, which is important. Humans type phrases with spaces. They also mention phish-resistant methods and most vendors are on-board with MS going to be turning off all Legacy Auth next month, across all free accounts and tenancies.

I'm so excited for the new changes!

Ok I'm off my soapbox.

Share the love! Thank you!

[Dries007 @driesk007]

@CottontailVA Programming,
Gaming,
Being annoyed at other people on the internet.

One might be the consequence of the others...

[Scott Manley @DJSnM]

SpaceX is going to destroy the International Space Station
https://t.co/ywDQaNjbdM

[Dries007 @driesk007]

@CodysLab Linux will be your saviour. I doubt you'd get enough bandwidth to Mars to get Windows update to work.
See also this fun article: https://t.co/yVLJpYSBVz

[Direwolf20 @Direwolf20]

🚨Security alert

A few curseforge mods were updated recently to contain malware. It *appears* an account or 2 may have been compromised. Most mods have been removed already, some haven’t.

Be safe, and consider not updating mods for a day or 2

Below list is *not* all inclusive

[Dries007 @driesk007]

Can someone from EU who gets reward points from CurseForge as a freelancer (aka self employed) tell me how they do the paperwork correctly? DMs open @CurseForge

[Dries007 @driesk007]

Omgekeerde wereld: Ik kan beter mijn GFT container wegdoen en alles in restafval gooien. Dat spaart mij 15€ per jaar uit, maar 1 keer per 2 weken die bak buitenzetten ipv 1 keer per week. Om geen meerkost te hebben moet ik 12+kg GFT (!) per maand hebben... @stadherentals

[Twoosie @Twoosiee]

Yeet privacy.

[Dries007 @driesk007]

@eevblog You guys don't use RFID cards there? Here in (western) Europe, most cards allow "roaming" across all other networks, so you pay slightly more, but it just works™
Some networks also support pay-by-app, but most don't.

[Eric Wastl @ericwastl]

Did you know? You can just put a "Do #AdventOfCode" ticket right into your sprint! If anyone asks who approved it, tell them it was me. ❤️

If that doesn't work, just rename it to something like "leverage enrichment synergies for improved engineering efficiency" or something. 📈

[Dries007 @driesk007]

@ericwastl I pre-booked 2 hours every workday from dec 1 till 25th. 4 days in total, best training I can imagine.

[Eric Wastl @ericwastl]

For Christmas, I made you 25 days of free programming puzzles. I hope you like them. 💕

🚨 We're less than two hours away from this year's #AdventOfCode 2022! 🚨

PS: How'd you first hear about AoC? I don't exactly advertise.

[Eric Wastl @ericwastl]

AAAAAAAAAAAAAAAAAAAA

[Dries007 @driesk007]

@Funwayguy @CurseForge For me it always has "holes" where there are days with no entry and then all of a sudden it jumps up 2~3x for a few days

[Twitch @Twitch]

An update on gambling on Twitch.

[The Royal Family @RoyalFamily]

The Queen died peacefully at Balmoral this afternoon.

The King and The Queen Consort will remain at Balmoral this evening and will return to London tomorrow.

[BBC Breaking News @BBCBreaking]

Queen Elizabeth II, the UK’s monarch for the past 70 years, has died aged 96 https://t.co/nuFdc3PV49

[Dries007 @driesk007]

Live on twitch, finally fixing my Home Assistant integration! #twitch @home_assistant

[Dries007 @driesk007]

Live on #twitch developing more open source software for EV chargers! https://t.co/AlDPvP9Xj5