密码修改最佳实践
密码 NIST 安全
![](/data/attachment/album/201710/18/094012qnxe6erzko5y55no.jpg)


NIST 最近发表了四卷 [SP800-63b 数字身份指南](http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63b.pdf)。除此之外，它还对密码提供三个重要的建议：


1. 不要再纠结于复杂的密码规则。它们使密码难以记住。因为人为的复杂密码很难输入，因此增加了错误。它们[也没有很大帮助](https://www.wsj.com/articles/the-man-who-wrote-those-password-rules-has-a-new-tip-n3v-r-m1-d-1502124118)。最好让人们使用密码短语。
2. 停止密码到期。这是[我们以前使用计算机的一个老的想法](https://securingthehuman.sans.org/blog/2017/03/23/time-for-password-expiration-to-die)。如今不要让人改变密码，除非有泄密的迹象。
3. 让人们使用密码管理器。这就是处理我们所有密码的方式。


这些密码规则不能[让用户安全](http://ieeexplore.ieee.org/document/7676198/?reload=true)。让系统安全才是最重要的。




---


作者简介：


自从 2004 年以来，我一直在博客上写关于安全的文章，以及从 1998 年以来我的每月订阅中也有。我写书、文章和学术论文。目前我是 IBM Resilient 的首席技术官，哈佛伯克曼中心的研究员，EFF 的董事会成员。




---


via: <https://www.schneier.com/blog/archives/2017/10/changes_in_pass.html>


作者：[Bruce Schneier](https://www.schneier.com/blog/about/) 译者：[geekpi](https://github.com/geekpi) 校对：[wxy](https://github.com/wxy)


本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出


OK
## Changes in Password Best Practices

NIST recently published its four-volume [ SP800-63b Digital Identity Guidelines](http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63b.pdf). Among other things, it makes three important suggestions when it comes to passwords:

- Stop it with the annoying password complexity rules. They make passwords harder to remember. They increase errors because artificially complex passwords are harder to type in. And they
[don’t help](https://www.wsj.com/articles/the-man-who-wrote-those-password-rules-has-a-new-tip-n3v-r-m1-d-1502124118)that much. It’s better to allow people to use pass phrases. - Stop it with password expiration. That was an
[old idea for an old way](https://securingthehuman.sans.org/blog/2017/03/23/time-for-password-expiration-to-die)we used computers. Today, don’t make people change their passwords unless there’s indication of compromise. - Let people use password managers. This is how we deal with all the passwords we need.

These password rules were failed attempts to [fix the user](http://ieeexplore.ieee.org/document/7676198/?reload=true). Better we fix the security systems.

Brian • October 10, 2017 6:51 AM

I agree basically, but doesn’t 3) kinda make 1) and 2) obsolete? If I use a pw manager and don’t have to remember them, don’t complex rules or auto generated passwords with high complexity actually do make them more secure?

1) is in place because people cannot remember complex passwords and reuse the same over multiple accounts.

So … if you use a pw manager, do use complex passwords.