Data
The Wall Street Journal article says:
The problem is the advice ended up largely incorrect, Mr. Burr says.
Change your password every 90 days? Most people make minor changes
that are easy to guess, he laments.
In that context the "90 days" appears to be his current summary of what was put in place as the result of his recommendations 15 years ago. I do not read that as quoting NIST 800-63 v1.0 as saying "90 days" anywhere. And when we look at the Verge article, which appears to be based on the WSJ article, they've changed that to:
Even worse, Burr suggested people should change passwords regularly,
at least every 90 days.
I don't get that from the original quote, and I think that it's a mis-representation of the original quote.
So let's look at the "original", or at least, the oldest version I can find: NIST SP 800-63 Version 1, September 2004. (A list of many versions is available from NIST.)
Appendix A does not contain any reference to 90 days. It does contain a reference to 90 years:
Such a lock out would suffice to limit automated attacks to 3 trials a
minute and it would take about 90 years to carryout 2^25.5 trials. If
the system required that password authentication attempts be locked
for one minute after three unsuccessful trials and that passwords be
changed every ten years, then the targeted password guessing attack
requirements of level 2 would be comfortably satisfied.
And he demonstrates how the entropy of a password and the lockout conditions can be used to calculate how susceptible a password is to online brute forcing:
For example, consider a system that required passwords to be changed
every two years and limited trials by locking an account for 24 hours
after 6 successive failed authentication attempts. An attacker could
get 2 ´ 365 ´ 6 = 4,380 attempts during the life of the password and
this would easily meet the targeted attack requirements of level 2.
If you search for keywords like 'change', 'rotate', 'hour', 'day', 'month' you will not find any specific advice which says passwords should be changed every 90 days.
That's the data we have. Now:
Opinion
Appendix A of SP 800-63 v1 explained the idea of entropy as a measurable aspect of passwords, described ways that more entropy could be employed in password strings of given lengths, and drew a connection between acceptable password timeframes based on average guessing with online constraints.
In practice, a lot of people looked at that and said "Okay, so we'll set password complexity requirements, and require rotation, and we'll be A-Okay!"
In hindsight, this was regrettable, for the following reasons:
- It discussed online brute force attacks, where delays can greatly slow down an attacks. The combination of Moore's law and offline brute force attacks shredded those assumptions like a tiger with a box of goat-flavored Kleenex.
- It had the overall effect of emphasizing short, complex passwords, just because it focused on exploring their mathematics. But the fact of the matter is, the Appendix itself knew this wasn't preferred! It said "...many people may prefer to memorize a relatively long “pass-phrases” of words, rather than a shorter,
more arbitrary password." Fast forward today, and where are we? "Passphrases are better than passwords." It's not Burr's fault people ignored that.
In summary, NIST SP 800-63 v1 may have been as damaging as Burr thinks it was - but it wasn't his fault. People drew short-sighted conclusions based on a report that stated up front how little data it had to work with in making recommendations. It was better than nothing at the time and it has been our failure - choosing to rely on it, rather than trying to resolve the lack of empirical data that the report called out.
On that note, I'll leave you with this part of the Appendix intro:
Unfortunately, we do not have much data on the passwords users choose
under particular rules, and much of what we do know is found
empirically by “cracking” passwords, that is by system administrators
applying massive dictionary attacks to the files of hashed passwords
(in most systems no plaintext copy of the password is kept) on their
systems. NIST would like to obtain more data on the passwords users
actually choose, but, where they have the data, system administrators
are understandably reluctant to reveal password data to others.
Empirical and anecdotal data suggest that many users choose very
easily guessed passwords, where the system will allow them to do so.