Claudius Link<p>Moving on to <a href="https://infosec.exchange/tags/Password" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Password</span></a> <a href="https://infosec.exchange/tags/Guidance" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Guidance</span></a> in general</p><p>Microsoft offers the following Password Guidance<br><a href="https://www.microsoft.com/en-us/research/publication/password-guidance/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">microsoft.com/en-us/research/p</span><span class="invisible">ublication/password-guidance/</span></a></p><p>Side note, the PDF contains no (visible) version information or date :-(<br>Please, if you publish guidance, especially if you are an influential company, include a date in your documents. I treat a guidance form 2016 differently than a guidance from 2023</p><p>Back to the recommendations. Most of the are solid but some stick out</p><p>1. Maintain an 8-character minimum</p><p>That seem awfully short. <a href="https://infosec.exchange/tags/NIST" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>NIST</span></a> states "Longer is better", the <a href="https://infosec.exchange/tags/HPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>HPI</span></a> recomend 15+ characters and, wait for it Microsoft themself recommends 12 or better 14+ characters.</p><p>4. Ban common passwords, to keep the most vulnerable passwords out of your system.</p><p>The NIST recommendation check against "commonly used and compromised passwords" considerably extends this!</p><p>Microsoft at other places recommends "Not a word that can be found in a dictionary or the name of a person, character, product, or organization."</p><p>5. Educate your users not to re-use their password for non-work-related purposes.</p><p>Work related reuse is OK????</p><p>I would love to know if <a href="https://infosec.exchange/tags/Microsoft" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Microsoft</span></a> internally really follows these password rule. Or if they enforce a more strict set. If anyone knows about this, please let me know (but don't if this would gt you fired)</p><p>BTW, the other place were Microsoft recommends a different/stronger set of password rules is here (gain no date):<br><a href="https://support.microsoft.com/en-us/windows/create-and-use-strong-passwords-c5cebb49-8c53-4f5e-2bc4-fe357ca048eb" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">support.microsoft.com/en-us/wi</span><span class="invisible">ndows/create-and-use-strong-passwords-c5cebb49-8c53-4f5e-2bc4-fe357ca048eb</span></a></p><p><a href="https://infosec.exchange/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Cybersecurity</span></a> <a href="https://infosec.exchange/tags/Fail" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Fail</span></a> <a href="https://infosec.exchange/tags/SecurityFail" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SecurityFail</span></a></p>