Complicated passwords make you less safe, experts now say.
Using a mixture of character types in your passwords and
regularly changing passwords are officially no longer best
password management practices.
For years, conventional wisdom advocated for passwords
that were highly complex, combining upper and lower case
letters, numbers and symbols. Over time, NIST found that
this focus on complexity was counterproductive and actually
weakened security in practice.
The new guidelines were published in September 2024 as
part of NIST’s second public draft of SP 800-63-4, the
latest version of its Digital Identity Guidelines.
Password strength is often measured by entropy, which is a
measure of unpredictability. While complexity can contribute
to entropy, length plays a much bigger role. (As the actress
said to the Bishop.) Sorry.
A longer password with more characters has exponentially
more possible combinations.
Long passwords that are easy to remember, such as
passphrases made up of several simple words. For example,
“big dog small rat fast cat purple hat jello bat” in password
form, so minus the spaces, “bigdogsmallratfastcatpurplehatjellobat”
is both secure and user-friendly. A password like this strikes
a balance between high entropy and ease of use.
A 64-character password using only lowercase letters and real
words would be extremely difficult to crack. If capitalised letters
and symbols are included, cracking the password would be close
to mathematically impossible.
—This is all very well, and makes a lot of sense, but I see two
drawbacks with this report, one major and one minor. Who,
in their right brain (I'm a "left brain" person ha ha) is really
going to manually type in 64 characters whenever they choose
to log into a site? I'd guess nobody!
And the minor(?) problem? How many sites will allow you to
type in a 64-charcter password/code? I encounter plenty of
sites that reject my 10-character password with the message
"Maximum 8 characters exceeded" (or similar).
Using a mixture of character types in your passwords and
regularly changing passwords are officially no longer best
password management practices.
For years, conventional wisdom advocated for passwords
that were highly complex, combining upper and lower case
letters, numbers and symbols. Over time, NIST found that
this focus on complexity was counterproductive and actually
weakened security in practice.
The new guidelines were published in September 2024 as
part of NIST’s second public draft of SP 800-63-4, the
latest version of its Digital Identity Guidelines.
Password strength is often measured by entropy, which is a
measure of unpredictability. While complexity can contribute
to entropy, length plays a much bigger role. (As the actress
said to the Bishop.) Sorry.
A longer password with more characters has exponentially
more possible combinations.
Long passwords that are easy to remember, such as
passphrases made up of several simple words. For example,
“big dog small rat fast cat purple hat jello bat” in password
form, so minus the spaces, “bigdogsmallratfastcatpurplehatjellobat”
is both secure and user-friendly. A password like this strikes
a balance between high entropy and ease of use.
A 64-character password using only lowercase letters and real
words would be extremely difficult to crack. If capitalised letters
and symbols are included, cracking the password would be close
to mathematically impossible.
—This is all very well, and makes a lot of sense, but I see two
drawbacks with this report, one major and one minor. Who,
in their right brain (I'm a "left brain" person ha ha) is really
going to manually type in 64 characters whenever they choose
to log into a site? I'd guess nobody!
And the minor(?) problem? How many sites will allow you to
type in a 64-charcter password/code? I encounter plenty of
sites that reject my 10-character password with the message
"Maximum 8 characters exceeded" (or similar).
I'm a creationist... I believe that man created God.
