Wstg: Outdated advice in password policy / brute force resistance articles

[patrickceg]

Describe the issue
I found this while checking 4.5.7_Testing_for_Weak_Password_Policy_OTG-AUTHN-007.md for migration testing. It had a string:

"When must a user change their password? After 90 days? After account lockout due to excessive log on attempts?"

This particular "after 90 days" is based on old advice that was actually overturned by NIST. Therefore, we should look over ALL of the items regarding brute force attacks and passwords to see if we should update some of the text.

EDIT: As comments mentioned, the other way to fix this is to refer to well known (and up to date) password or other identity guidelines instead of duplicating them in our guide.

~Some of the advice may include (but should be verified with more references as I'm just thinking of this from memory):~

• ~Allowing correct horse battery staple style passwords as being "strong" provided sufficient entropy (instead of just asking for two symbols, a bunch of numbers, an uppercase letter, and a lower case letter which results in _Pa$$word123456789!_ )~
• ~Saying it's NOT a good idea to change passwords arbitrarily, or else you get passwords of Summer2019$! -> Autumn2019@! -> Winter#!2020 ...~

[victoriadrake]

To expand on a point @kingthorin made in Slack, it may be more prudent of us to avoid being too detailed with prescriptions and instead refer to the CheatSheet, or to NIST Digital Identity Guidelines as the CheatSheet does. This has the added advantage of not relying on OWASP's contributors to keep these prescriptions up-to-date in different places.

[patrickceg]

That works for me as well, and it makes sense given the scope of the document. Best to link to "defenders" guides rather than expand out our scope beyond the "breakers" role :)

Original post edited (with the old text kept for historical purposes)