Study. uk . com
  1. Home
  2. All questions
  3. Question 321

CISSP study material · question 321 of 500

A login page disables pasting into the password field to discourage credential sharing. What does NIST SP 800-63B say?

  1. Pasting may be blocked provided a password manager plugin is offered instead.
  2. Pasting must be blocked at AAL2 and above.
  3. Verifiers must allow password managers and autofill, and should permit pasting where autofill interfaces are unavailable.
  4. Pasting is permitted only where the password is used within multi-factor authentication.
Show the answer

Answer: C. Verifiers must allow password managers and autofill, and should permit pasting where autofill interfaces are unavailable.

SP 800-63B requires verifiers to allow password managers and autofill and says they should permit the paste function, because managers help subscribers choose stronger passwords.

Source: NIST SP 800-63B Rev. 4 (NIST) — SP 800-63B-4 > 3.1.1.2 Password Verifiers

Challenge yourself on this topic → Study as cards