☇ That check ain’t blue

[☇ That check ain’t blue @jasongull]

@morninggloria You might consider having a conversation about this with Ginanne Brownell, author of “Elusive Mommyhood” (https://t.co/goJMuWlCAp)

[David Frum @davidfrum]

I posted the below last night in an emotional mood. It was answered by many generous comments in remembrance of my lost Miranda, and I thank every commenter. Of course there were also some other comments. A thread about those....

[Jason Kint @jason_kint]

Here is the full report but I’d be curious how the initial tweet travels if you don’t mind sharing it especially with the subject at hand. https://t.co/cdjGfhyZOw

[☇ That check ain’t blue @jasongull]

Noted critic Tom Sietsema's columns will now focus exclusively on providing readers useful information such as restaurant addresses and hours of operation.

[☇ That check ain’t blue @jasongull]

The Washington Post announced today that it will stop endorsing restaurants and return to its traditional, "independent" roots by merely reprinting menus from area eateries.

[☇ That check ain’t blue @jasongull]

@RoseSilicon @AriCohn Um... 17 U.S.C. § 506 https://t.co/0OsMv0uAWU
and § 105? https://t.co/pfCv0HbfDG

[SaferConnAveDC 🚲🏃‍♀️🚍 @DcSafer]

Leadership, something which @MayorBowser is gravely lacking.

[☇ That check ain’t blue @jasongull]

Tim is wrong about the fire-in-a-crowded-theatre thing. JD is wrong about … everything else.

[BlackRoomSec @blackroomsec]

Please share this far and wide. As far and wide as you can. NIST Password Guidelines for 2024 are in the process of being updated.

This is a HUGE pet-peeve of mine (when vendors in particular are still operating like its 2017 and keep changing passwords every 60 days, STOP DOING THIS, it's outdated and has been shown to put you MORE at risk than less -- NIST explains why it does in this document, meticulously outlining user behavior**) so I'm sharing this in the hopes all of you will pass it along to your bosses.

The Special Publication series governing passwords is SP 800-63 "Digital Identity Guidelines".

The 2024 version is 800-63-4.

Here: https://t.co/oX8YEJHxXg

The companion docs are also on that link. They are 800-63A, 800-63B and 800-63C. These are different documents for different scenarios in play at your org.

The previous update was in2020.

The changes in the 2020 version from the 2017 version were numerous but one of them was that the password verification method should NO LONGER require passwords be changed at specific intervals (i.e. every 60 days) but in the following circumstances instead:

1. After a breach/compromise
2. User request

2024 repeats this and adds a bunch more guidlines but here is a screenshot of page 13 of the new 800-63-4 (note the # 4 after it) which outlines how your systems should now and moving forward, be handling passwords.

This goes for Active Directory, too. All your systems which have passwords should align with these guidelines provided there isn't another standard or framework you must adhere to which overrules this.

Most frameworks, however, have moved away from arbitrary password resets and complexity rules.

**We cybersec researchers and hackers use wordlists from breaches in a variety of different ways. Hackers use them in tooling to crack passwords whereas researchers use breach dumps to see the kinds of passwords users are creating and the psychology behind them.

Using complexity rules gets you the user psychology of:

Password1
Password2
and so on

Use phrasing instead and allow for spaces, which is important. Humans type phrases with spaces. They also mention phish-resistant methods and most vendors are on-board with MS going to be turning off all Legacy Auth next month, across all free accounts and tenancies.

I'm so excited for the new changes!

Ok I'm off my soapbox.

Share the love! Thank you!

[☇ That check ain’t blue @jasongull]

@robertgraham ... believed he was referring only to a hypothetical subgroup of marchers as "fine," and may disagree whether white nationalists w/torches chanting nazi slogans all count as "neonazis," but it's not a "lie" to lump those groups together

[☇ That check ain’t blue @jasongull]

@robertgraham You seem to be taking T at his word when he said he had "condemned neo-nazis." He said those words, and *also* called torch-carrying marchers, at a march organized by the Daily Strmr, chanting antisemitic neonazi slogans, "very fine people." You may generously imagine that T ...

[☇ That check ain’t blue @jasongull]

@robertgraham …know just how bad the torch march was. Maybe he was backed into awkward corner. But he said tiki marchers included very fine people. You seem to assume that many non-neo-nazi marchers existed and that T meant only them. That’s a lot of assuming. 3/3

[☇ That check ain’t blue @jasongull]

@robertgraham He gets pushback to his blaming “alt left” and both sides =ly bad, so then suggests both sides (again, of the Fri night, “blood and soil,” “Jews will not replace us” march) had “very fine people.” And sure, he also said he wanted to get more facts, etc. maybe he didn’t …2/3

[☇ That check ain’t blue @jasongull]

@nickcjacobs @DcSafer @MayorBowser @DDOTDC What is "it"?

[☇ That check ain’t blue @jasongull]

@nickcjacobs @DcSafer @MayorBowser @DDOTDC Nick, paying only slightly closer attention to tweets about crosswalks than a typical Conn Ave driver pays to actual crosswalks, illustrates the point shown by "brick" experiments: drivers will pay more attention - or, you know, some - to pedestrians holding "bricks"

[☇ That check ain’t blue @jasongull]

@robertgraham Likewise, contra your recent post: not "Everyone babbles like Trump when they speak extemporaneously." Sure, not everyone can perfectly state detailed plans on cue. But most politicians have some notion of their plans and can describe them. Why let T off the hook when he can't?

[☇ That check ain’t blue @jasongull]

@robertgraham ... he is (explicitly) willing to accept this as a "fact of life" and (implicitly) unwilling to consider possible solutions outside a narrow band of defensive actions. Agree or not (and you don't have to!), that's a valid criticism of his stated position. Not a "lie".