Apps and websites have a bunch of rules to make your passwords safer – lots of characters, special symbols and frequent resets. But a federal tech agency is saying some requirements do more harm than good.
The National Institute of Standards and Technology (NIST) proposed new guidelines for protecting people’s digital identities from fraud. Among them are bans on password rules that cybersecurity experts have long been calling outdated. No more asking for special characters such as “%” and “$,” for instance. And no more security questions about your first pet or childhood best friend.
NIST said the changes are meant to help consumers choose strong passwords and avoid wasting time on unhelpful requirements. Research also suggests all those extra asterisks didn’t make our passwords that much safer.
“Highly complex passwords introduce a new potential vulnerability: They are less likely to be memorable and more likely to be written down …