SoylentNews is people
SoylentNews
Submitted via IRC for Bytram
We've all been forced to do it: create a password with at least so many characters, so many numbers, so many special characters, and maybe an uppercase letter. Guess what? The guy who invented these standards nearly 15 years ago now admits that they're basically useless. He is also very sorry.
[The 2003 NIST guidance has been replaced by a new version of NIST Special Publication 800-63A, "Digital Identity Guidelines: Enrollment and Identity Proofing Requirements." which is basically a 180° reversal from the original. - Ed.]
Source: http://gizmodo.com/the-guy-who-invented-those-annoying-password-rules-now-1797643987
Additional Coverage at The Wall Street Journal[paywalled]
This discussion has been archived.
No new comments can be posted.
The Guy Who Invented Those Annoying Password Rules Now Regrets It
|
Log In/Create an Account
| Top
| 24 comments
| Search Discussion
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
I'm wearing PAMPERS!!
(Score: 2) by AthanasiusKircher on Friday August 18 2017, @10:48AM
Perhaps the most annoying policy like this I ever encountered was a system that refused to accept any password with a string of more than two letters or two numbers in a row. Nominally, the rationale the system offered in explanation was to avoid dictionary-based attacks for passwords made up of words. But the system didn't actually know any words: it just assumed if you entered three or more letters in a row, it was a "word." Hence, you'd get an error message like, "Sorry, but that password is too weak. Avoid making passwords up from common recognizable words like 'xgq'. Combinations of letters, numbers, and symbols provide strong protection for your account. Please enter another password."
It didn't actually explain what its actual rule was to you, mind you. I believe it mentioned avoiding "words" with 3 or more letters, but you could only figure out that a "word" was any three letters in a row through trial and error. The rule became clear after a few attempts, and I did at some point verify with IT that this was actually the way the system worked.
There was a minimum 8-character limit too, but I'm not sure if there were any other stipulations. Nevertheless, if you tried a 20-character password like Tom3ato98s!v2P4&#%q5, it would be summarily rejected for the words "Tom" and "ato," but if you tried a password like "aa11aa11" you were fine. By the way, this was at a large major institution of higher ed, not just a random small company or something.