Here is the text of the NIST sp800-63b Digital Identity Guidelines.

  • frezik@midwest.social
    link
    fedilink
    English
    arrow-up
    1
    ·
    edit-2
    1 month ago

    OK. How do you reconcile that with “Hashing passwords isn’t even the best practice at this point”? Key derivation functions are certainly the recommended approach these days. If they are hashes, then your earlier post is wrong, and if they aren’t hashes, then your next post was wrong.

    • orclev@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 month ago

      The rest of that sentence is important. Hashing passwords is the minimum practice, not best practice. You should always be at least hashing passwords. Best practice would be salting and peppering them as well as picking a strong hashing function with as high a number of iterations as you can support. You would then pair that with 2FA (not SMS based), and a minimum password length of 16 with no maximum length.