The National Institute of Standards and Technology (NIST) issued an update to its password guidelines in June 2017 titled Digital Identity Guidelines (SP 800-63-3). Many of the guidelines that previously existed in the industry as best practice with credentials have been replaced with simpler, more user-friendly approaches.

Examples of new guidelines in the Digital Identity Guidelines (SP 800-63-3):

Length of passwords between 8 – 64 characters are recommended.
Character types of nonstandard characters, such as emoticons, are allowed when possible.
Long passphrases are encouraged and should not match entries in the prohibited password dictionary
Password reset frequency should be primarily triggered on if the password is compromised or forgotten
Multifactor Authentication is encouraged in all but the least sensitive applications

Related Links and Additional Reading:

NIST’s New Password Rule Book: Updated Guidelines Offer Benefits and Risk

Google Chrome Forensics

July 11, 2017

Leonard Nelson

Security No Comments

The Chromensics tool is developed to read all information from chrome browser directory and present it to user, in easy readable tabular format which can be explored in descent interface without running the chrome browser. The tool will also allow you retrieve information from other chrome installation brought from different machine for analyzing. The acquired artifacts can be exported in PDF report to present it in court of law or to superiors.

The Password Reset MitM Attack

July 3, 2017

Leonard Nelson

Security No Comments

An interesting approach to a Man-in-the-Middle Attack against a Password Reset System

The PRMitM attack exploits the similarity of the registration and password reset processes to launch a man in the middle (MitM) attack at the application level. The attacker initiates a password reset process with a website and forwards every challenge to the victim who either wishes to register in the attacking site or to access a particular resource on it.

Source: The Password Reset MitM Attack

FeeX – Retirement Fees Analyzer

May 20, 2017

Leonard Nelson

Productivity No Comments

Nearly all investments — including those in IRA, 401(k), 403(b), 457 and brokerage accounts — have fees. FeeX is a free service that finds these fees and helps you reduce them. FeeX’s mission is to make sure you keep as much of your own money as possible, instead of losing it to excessive fees. FeeX does not evaluate your investment choices or strategy. Instead, FeeX finds ways for you to invest according to your choices while paying the lowest fees available. In order to help you switch to similar low-fee alternatives, FeeX presents alternative investments with better past returns (when possible) than your original investments.

Source: FeeX