SoylentNews is people
SoylentNews
Submitted via IRC for Bytram
We've all been forced to do it: create a password with at least so many characters, so many numbers, so many special characters, and maybe an uppercase letter. Guess what? The guy who invented these standards nearly 15 years ago now admits that they're basically useless. He is also very sorry.
[The 2003 NIST guidance has been replaced by a new version of NIST Special Publication 800-63A, "Digital Identity Guidelines: Enrollment and Identity Proofing Requirements." which is basically a 180° reversal from the original. - Ed.]
Source: http://gizmodo.com/the-guy-who-invented-those-annoying-password-rules-now-1797643987
Additional Coverage at The Wall Street Journal[paywalled]
This discussion has been archived.
No new comments can be posted.
The Guy Who Invented Those Annoying Password Rules Now Regrets It
|
Log In/Create an Account
| Top
| 24 comments
| Search Discussion
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
It's raisins that make Post Raisin Bran so raisiny ...
(Score: 2) by looorg on Friday August 18 2017, @01:41PM
The term 'invent' seems a bit of an overstatement. He was a bureaucrat that wrote down a summary because the higher ups wanted documentation, unfortunately he did a really bad and lazy job. Which if nothing else he should feel bad and be ashamed for. So he was mostly basing it back then on thinking already decades old when the idea was all about increasing the pool of potential characters, making a brute force attack take longer. We are talking the 1980's here so a typical CPU was running at best at MHz speeds and GPU cracking wasn't a thing. Dictionary attacks already existed so picking normal words like 'password' was bad already back then; while 'pASSw0RD' would be a lot better since it required you to increase the pool of potential characters you had to test from just A-Z to something many times greater. Standardizing made it both better and worse tho as it increased the permutation pool but it also created patterns since passwords had to contain certain combinations so the actual numbers of permutations was always then lower then the potential maximum.
So with all due credit to the compulsory XKCD comic, it forgets to factor in the speed was a lot slower back then from where and when he took the ideas. There was no 1000 guesses per second. Neither did implemented password systems allow for you to have massively long passwords. In the end hardware improvements made the rules obsolete. So today correcthorsebatterystaple is a better password then Tr0ub4dor&3 but wasn't always the case.