Pwning Password Complexity: Simple, Long-Lived Passphrases in the Real World
Channel: FIRST
Date: 2021-02-12

Complex passwords harm user security when they must be frequently changed and are little defense against credential stuffing and phishing. Standards like NIST SP800-63b show organizations how to remove password complexity and periodic rotation but require additional controls, including checking candidate passwords against lists of known-compromised credentials. Operating under these new controls is harder still: Have you been ""pwned""? How can a CSIRT ensure that compromised user passwords are appropriately revoked in a compromised password store?

A successful implementation will be a rare win-win: a security control that will improve both security posture and user experience. The author will describe implementing this in the real world: compliance with NIST SP800-63b; maintaining a local compromised password store; answering queries about password compromises; and identifying several lessons learned from the cross-platform implementation project.
--
Seth Hanford is a Principal Engineer at Proofpoint. In his role, he serves as security architect, and as an advisor to the enterprise CSIRT, PSIRT, and other Global Information Security functions responsible for designing secure architectures and protecting customer and enterprise data for the company. He has previously worked as Sr. Manager for Detection & Response for a Fortune 100 financial services firm, as well as various vulnerability & threat intelligence roles, and as a PSIRT incident manager for a Fortune 100 network technology company. He has been active in the FIRST community over the past decade, including service on the CVSS SIG during v2, and as SIG chair for the development of CVSS v3.