Authentication and Password Guidelines Quiz

Answer: Enrollment & Identity Proofing

One of a website's most important requirements is ensuring that only you can access your account, especially for any financial accounts. Identity proofing can be complicated to implement, and has been implemented in many ways. The new guidelines took a risk-based approach.

For example, a website that has no personal information doesn't have the same security requirements as a bank or investment site.

Answer: Must be user friendly

Past standards have put much responsibility on the individual users for maintaining password security, but the revised standard put more of the burden on the password verifier.

Now, this doesn't absolve the user from making sure their password is secure. Alas, many users must not really understand as the most common password in use between 2013 and 2017 (according to security firm SplashData) is 123456.

Answer: yes

One way to remember longer passwords is to use a passphrase rather than just a combination of unrelated characters. The 2016 standard requires that 64 characters be accepted and used. The "and used" portion of the requirement is important because some password applications allow more characters than are counted as significant (i.e., it might allow more than 8 characters, but only apply the encryption methodology to the first 8).

When passwords are stored they shouldn't be recoverable. This can be accomplished by "salting" the input password with additional characters and then "hashing" or scrambling the results.

Answer: composition rules

Truly, adding composition rules didn't effectively inhibit the ability of hackers to break passwords such as pa55w0rd or letme1n. The intent is to allow greater password creativity by having users create longer passwords or passphrases that they will remember more easily.

Answer: It was not specified

The recommendation in the 2016 guidelines was to use a dictionary to prevent the use of common, simple words. However, no specific size was recommended. At that time it was acknowledged that some research was still required to determine the correct size - too small and it will be ineffectual, too large and the user will be impacted. Other items for inclusion could be passwords known to be compromised, sequential repetitive characters (e.g., 8888888 or 123123), or context specific passwords (e.g., gmailemail for a google mail account).

The guidelines also acknowledged is the issue of what to do when users are told to choose another password and the next one is really not an improvement, e.g., password7 to password8.

Answer: No requirement for periodically changing passwords

It is generally accepted that users cheat when it becomes difficult. Well, remembering a new complex password or passphrase every 90 days would be tough. So some may simply make it easier for themselves by making minor changes: e.g., the password Iwantadog2 at the next password change will become Iwantadog3.

If a password has been compromised, it should be changed immediately. Any password that comes as a default with a system or device should also be changed at once.

Answer: password-strength meter

The guidelines recommended that the password-strength meter be added so that users can easily know whether or not they are creating a strong password. This is felt to be most important when the previous password has been rejected.

Users should just remember that a password-strength meter is code written to help, but the ultimate responsibility for a secure password still rests with them. There are many theories about what makes the most secure password, but the current NIST recommendation is more about length than extreme complexity.

Answer: knowledge-based authentication

Many sites implement knowledge-based authentication by supplying a list of "random" questions which you answer. Some actually let you create the questions and answers. Either way NIST recommended that these type of questions be removed because they are so easily hacked.

An example of one of these questions is "What's your favorite color?" Most answers fit within a small number of colors such as blue, green, red, pink, yellow, or purple.

Answer: two-factor authentication

The use of two-factor authentication is intended to be a more secure method. Two-factor authentication is intended to use something you know (password) and something you have (the code sent to you on a token, via email, or SMS (short message service)).

However, in the 2016 version of the NIST Digital Identity Guidelines, it was recommended that all SMS messages be eliminated. Some of the reasons include the fact that users change phone numbers and the current level of security of smartphones.

Answer: biometric

Many of us use biometrics, such as a fingerprint, to access our personal devices. One change made to this version of the guidelines was that biometrics can only be used as a part of a two-factor authentication. The recommendation is that a presentation attack detection method is also implemented. An example would be a facial scan followed by a request to read something randomly provided and then verified with lip reading or speech recognition.