NIST joins Microsoft in Changing How We Should Think About Passwords

Microsoft's Password Guidance white paper, drawing on billions of Azure AD logins, advises dropping composition rules and periodic resets, keeping an 8-character minimum, and enforcing risk-based MFA.

NIST's newly drafted digital identity guidelines analyzed: passwords checked against breach lists, dictionary words and context terms; SMS dropped as a single factor as push-based MFA gains ground.

After cracking ~40% of passwords in AD environments, the post recommends disabling forced expiry (max age 0), raising minimum length toward 16, and passphrase training — cutting crack rates to ~5%.

Delegating user management in AD requires least privilege, yet legacy rights like password options reachable by Authenticated Users can silently widen access. The post shows how to harden it.

SaaS passwords multiply like cockroaches; the post explains how IDaaS services (Azure AD, Okta) fight back with password vaulting and browser replay—and the five security weaknesses that remain.

An analysis of 'unbreakable' devices that change the password every 60 seconds: probabilistically, rapidly rotating passwords add little security over static ones — such marketing is snake oil.