Summary

The NIST 800-63-3B guidelines have received a fair amount of criticism for contradicting the previous password guidelines imposed by NIST, such as password-expiration policies, using special characters, and complexity requirements. The guidelines have been criticized for allowing users to use passphrases as passwords without complexity, even though the strength of passwords based on characters only are technically weaker passwords. Even so, the guidelines do provide some good information. I recommend taking what is useful and marrying it with the latest information we have in order to secure your passwords.

In conclusion, using multi-factor authentication is imperative to prevent phishing and account attacks. The NIST 800-63-3B guidelines represent a move toward flexibility in password creation and emphasize education, but it is crucial to be cautious about where they may differ from previous password guidelines. The implementation of the guidelines should be a priority...