NIST generally knows what they're doing. Want to overwrite a hard drive securely? NIST 800-88 has you covered. Need a competition for a new block cipher? NIST ran that and AES came out of it. Same for a new hash with SHA3.

I hate that anyone has to be told not to truncate passwords. Like even if you haven't had any training at all, you'd have to be advanced stupid to even come up with that idea in the first place.

9. Don't truncate passwords for verification.

It needed to be said. Because some password system architects have been just that stupid.

Edit: Fear of other's stupidity is the mind killer. I will face my fear. My fear will wash over me, and when it has passed, only I will remain. Or I'll be dead in a car accident caused by an AI driver.

Don’t bug users to change passwords periodically. Only do it if there’s evidence of compromise.

This is a big one. Especially in corporate environments where most of the users are, shall we say, not tech savvy. Forcing people to comply with byzantine incomprehensible password composition rules plus incessantly insisting that they change their password every 7/14/30 days to a new inscrutable string that looks like somebody sneezed in punctuation marks accomplishes nothing other than enticing everyone to just write their password down on a Post-It and stick it to their monitor or under their keyboard.

Remember: Users do not care about passwords. From the perspective of anyone who isn't a programmer or a security expert, passwords are just yet another exasperating roadblock some nerd keeps putting in front of them that is preventing them from doing whatever it is they were actually trying to do.

NIST are bureaucrats sure, but bureaucrats with lots and lots of practical experience.

Only issue I see is that the 8 chars required is very short and easy to brute force. You would hope that people would go for the recommended instead, but doubt it.

re #7, I hope they are also saying no 'secret questions' to reset the password?

I was expecting idiotic rules screaming "bureaucratic muppets don't know what they're legislating on", but instead what I'm seeing is surprisingly sane and sensible

NIST knows what they're doing. It's getting organizations to adapt that's hard. NIST has recommended against expiring passwords for like a decade already, for example, yet pretty much every IT dept still has passwords expiring at least once a year.

You should accept Unicode; if doing so, you must count each code as one char.

Hmm. I wonder about this one. Different ways to encode the same character. Different ways to calculate the length. No obvious max byte size.