The man who first wrote about the importance of password strength now regrets his decision, and his reticence could have implications for the way IT managers set user security policies.

In 2003, IT expert Bill Burr suggested that passwords should be complex, changed regularly and include a broad range of characters. Almost 15 years later, he revised his stance due to the difficultly of remembering passwords and the pain it causes users.

Outdated Password Strength Recommendations

While Burr was a manager at the National Institute of Standards and Technology (NIST) in 2003, he wrote a paper outlining recommendations for passwords. Organizations and individual users around the globe then adopted these recommendations as rules for access credentials.

As standard practice, many websites now force users to include numbers and capital letters. Others require the inclusion of special characters. But as a result of these requirements, websites often prevent people from using passwords that are easy to remember.

However, Burr suggested to The Wall Street Journal that these recommendations might have done more harm than good. Rather than helping to protect information, users still choose bad passwords, and these strings are often unnecessarily complex and hard to remember.

Changing Guidelines

The good news for users is that Burr’s original paper was rewritten in June of this year. The new publication, “NIST Special Publication 800-63-3: Digital Identity Guidelines,” included fresh password guidelines recommending the use of long, easy-to-remember phrases instead of words with special characters.

Even better news? These longer phrases are much harder to crack. For example, it would take a botnet cyberattack 1 trillion years to crack the passphrase “horsecarrotsaddlestable,” The Telegraph reported. In comparison, the string “P@55w0rd,” which relies on complex characters, would be cracked in just one minute.

The new NIST paper made another important recommendation. According to Engadget, the guidelines stated that policies that force users to change passwords every 90 days often result in people simply changing a number or character. Instead, forced password changes should only take place in the aftermath of a security breach.

Does Technological Innovation Provide an Answer to the Password Challenge?

Experts have long predicted the demise of passwords, according to The Independent. There is hope that advanced technology, such as biometrics, will help replace the need for passwords and passphrases in the future.

This goes beyond fingerprint scanning: Yahoo’s Research Labs, for example, use anything from ears to knuckles to the barest edge of fingertips to unlock mobile devices. For now, however, the reliance on strings is likely to persist until the adoption of advanced biometric methods becomes widespread.

In the meantime, strengthening the content of passwords under the new NIST guidelines will make it harder cybercriminals to crack access codes. Encouragingly, researchers at Duo Labs recently discovered that users are beginning to adopt longer passwords, such as the passphrases suggested by NIST.

These revelations will leave some IT managers to question the relevance of internal security policies, many of which refer to tight password characteristics and regular resets. Security professionals should review their company policies and ensure that the approach is in line with the NIST recommendations and best practices.