Password usability and outdated advice

Entry. A password too long or complex is hard to type correctly, especially on a phone keyboard. Since 2010, common password rules have required at least one lower-case letter, one upper-case letter, a digit and a special character — a combination that is fiddly to enter reliably under any conditions. The lecture’s example of the entry concern taken to its limit: US nuclear weapons firing codes are only 12 decimal digits, because testing found that was the maximum length operators could reliably convey under extreme stress, over degraded or improvised communication channels. Users, without that pressure, still default to simple passwords for the same underlying reason — to enter them correctly and quickly.

Memory. Standard password advice has always contained a contradiction: “choose a password you can’t remember, and don’t write it down.” Unpredictability is what defeats guessing and dictionary attacks, but unpredictability is exactly what human memory struggles to hold. Whether writing a password down is reasonable depends on where: writing one down at home, where only trusted family members have access, is usually fine; writing one down at an open-plan office desk is not. In theory every site should get a different password, since a breach on one site can expose a username and password pair an attacker then tries elsewhere — in practice, with dozens of accounts to manage, most people cannot memorise that many distinct strong passwords at once.

Outdated advice: expiry rules. Forcing a password change every 30, 60, 90 or 180 days is bad advice for two reasons. A strong password, stored correctly, does not weaken with time, so expiring it protects nothing. And since people can reliably hold only a handful of strong passwords at once, forcing frequent changes pushes them toward progressively weaker choices, with passwords across different logins converging as memorable options run out. The corrected advice — do not expire a password unless you suspect it has been compromised — has been UK government policy since 2015, and Australia adopted the same position in 2017. NIST SP 800-63B currently agrees: it tells verifiers not to require periodic mandatory password changes.

Outdated advice: composition rules. A rule like “6-12 characters, at least one special character, at least two numbers” does not reliably track strength. It accepts Password123! — a predictable pattern any attacker’s dictionary already contains — and rejects geyps5aykj0q71c637n9gf4ycg, a far higher-entropy string that has no special character and exceeds the rule’s 12-character cap. Compliance with a composition rule and actual unpredictability are not the same property.

A cheaper and more effective check does not test composition at all: check the candidate password against dictionaries in any language, against lists of passwords attackers have already tried, and for common substitutions (4 for A or R, 3 for e, 7 for L) and disguised dates. The reasoning is cost: brute force is expensive and attackers use it only as a last resort, so a dictionary-and-substitution check defeats the attack they will actually try first. NIST SP 800-63B currently agrees here too — it tells verifiers not to impose arbitrary composition rules.