Gunnar Guðvarðarson: NIST Special Publication 800-63B

2018-08-21T13:15:30Z

NIST Special Publication 800-63B

Sven Neuhaus: some suggestions

2015-02-06T09:48:32Z

some suggestions

New page

I have a few suggestions for this page:

=== General Guidelines ===
==== User IDs ====
===== Email address as a User ID =====
====== Validation ======

"To ensure an address is deliverable, the only way to check this is to send the user an email and have the user take action to confirm receipt."

Another, less obtrusive way of making sure an email address is deliverable is to use the "RCPT TO" command during a SMTP dialogue and making sure you get a "250" or "251" response. There may be a temporary error if the server uses greylisting.

=== Password length ===

Why is there the recommendation of having a maximum password length of 128?

=== Password complexity ===

This should mention UTF-8 characters, making sure they are legal to enter.

=== Utilize Multi-Factor Authentication ===

This should mention receiving the token via SMS as it is a separate channel (not the internet),
which provides security benefits.

=== Authentication and Error Messages ===
==== Correct Response Example ====

If the response doesn't specify whether the username is wrong (does not exist) or the password,
that is an inconvenience for the user, especially if she/he doesn't notice the error.
Many times, there is an alternative way of finding valid usernames anyway, so there is no additional security gained. Use good judgement.

=== Use of authentication protocols that require no password ===

Mozilla Persona is missing in this list, it seems to be the best solution in terms of privacy, its only problem is a lack of adoption, something this cheat sheet could change.

[[User:Sven Neuhaus|Sven Neuhaus]] ([[User talk:Sven Neuhaus|talk]]) 03:48, 6 February 2015 (CST)

← Older revision		Revision as of 13:15, 21 August 2018
Line 35:		Line 35:

	[[User:Sven Neuhaus\|Sven Neuhaus]] ([[User talk:Sven Neuhaus\|talk]]) 03:48, 6 February 2015 (CST)		[[User:Sven Neuhaus\|Sven Neuhaus]] ([[User talk:Sven Neuhaus\|talk]]) 03:48, 6 February 2015 (CST)
		+
		+	=== Adapting the password complexity section to conform to NIST Special Publication 800-63B ===
		+
		+	I'd like to suggest replacing the password complexity section with [https://pages.nist.gov/800-63-3/sp800-63b.html#appA Appendix A of NIST Special Publication 800-63B]. [[User:Gunnar Guðvarðarson\|Gunnar Guðvarðarson]] ([[User talk:Gunnar Guðvarðarson\|talk]]) 08:15, 21 August 2018 (CDT)

Talk:Authentication Cheat Sheet - Revision history

Gunnar Guðvarðarson: NIST Special Publication 800-63B

Sven Neuhaus: some suggestions