The latest password guidance sounds reassuring. Make passwords longer. Use at least 15 characters when a password is the only authentication factor. Screen passwords against known compromised credentials. Stop forcing people to change them every few months. Use password managers. All of that is sensible advice. It is also increasingly beside the point.
Secureframe recently summarized the latest NIST guidance and correctly noted that NIST now places greater emphasis on password length rather than complicated composition rules. NIST SP 800 63B 4 requires a minimum of 15 characters when a password is being used as a single authentication factor.
Buried inside the same NIST guidance, however, is a clear statement: “Passwords are not phishing resistant.” That should be the headline.
A 15-character password may be considerably harder to guess than an eight character password. A 30-character password may be exponentially harder to crack through brute force. But if I trick an employee into entering that password into a convincing Ai generated login page, its length becomes irrelevant. I do not have to crack it. I just got it.
With modern adversary in the middle phishing, I may be relaying that password to the legitimate website almost instantly. The employee thinks they are logging in normally while the attacker is sitting between the employee and the real service.
The same problem applies to many traditional forms of MFA. If the site then asks for a six digit authenticator code and the employee enters that code into the fake page, the attacker can relay that too.
NIST explicitly recognizes this problem. Its current guidance says authentication methods involving manual entry of an authenticator output, including OTP authenticators, are not considered phishing resistant because an impostor verifier can relay that output to the legitimate verifier and successfully authenticate.
That is a profound change in how enterprises should think about identity security.
The objective should no longer be merely to make credentials harder to guess. It should be to make credentials impossible to give away.
NIST recommends phishing resistant cryptographic authentication at higher assurance levels and requires phishing resistance at AAL3. Secureframe similarly recommends prioritizing phishing resistant MFA rather than using SMS or push notifications any longer. And today, shared passkeys using consumer devices such as phones are no longer phishing or malware resistant. This is where dedicated biometric hardware authentication represents the logical destination.
With TokenCore, there is no authentication code for an employee to read to someone. There is no push notification to approve. The cryptographic credential is stored on dedicated hardware and bound to the legitimate domain. Authentication requires the authorized user's fingerprint and physical presence. A fake website cannot simply ask the user to hand over the credential because the user does not possess anything transferable to hand over.
That distinction matters enormously. We should still use strong passwords wherever passwords remain. Longer passwords absolutely help against guessing, credential cracking, and some forms of automated attack. But enterprises should not confuse a stronger password with stronger identity.
A 15-character password surrendered to an attacker is compromised just as completely as a five character password.
The future of authentication is therefore not a better secret. It is an authentication system in which there is no secret the human being can reveal in the first place. NIST's own guidance is pointing us in that direction.
It is time for enterprise security architecture to follow it.