Have we been creating passwords the wrong way all along? You might think so, based on the new set of guidelines the National Institute of Standards and Technology (NIST) recently issued about the best password practices.

NIST Special Publication 800-63 is a comprehensive guide to managing digital identity, and its recommendations are widely adopted by organizations of all kinds. The most recent guidelines, which were issued in June, modify a 14-year-old sets of rules for password selection — some would say dramatically.

The original guidance, which was published in 2003, recommended the use of passwords composed of random strings of uppercase and lowercase text mixed with symbols. Passwords like “Q*!f7aRd^&23” thus became the holy grail of authentication. The new guidelines lean instead toward the use of long passwords composed of unrelated words, such as “dogbarnheliumsynchronousbudget.” Such passwords are easier to remember and just as hard to crack as their gibberish counterparts, according to the NIST.

Password Practices Past Their Prime?

The Wall Street Journal recently asked the author of the 2003 guidelines about the changes. Bill Burr, a former NIST manager who has since retired, said he now regrets the advice he put forth 14 years ago, saying the rules were too complicated for people to follow.

But the problem wasn’t the advice — it was people. A careful reading of the new guidelines shows that the NIST’s recommendations on password practices haven’t changed all that much, but they have been expanded to encompass new options.

The original guidelines are based on a concept called password entropy, which is a mathematical equation that evaluates the difficulty of cracking a password. In a 2010 academic report, a team of researchers from Florida State University, Redjack and Cisco IronPort Systems discounted the entropy principle as basically useless where humans are involved. They mined through millions of passwords and determined that a mix of letters, numbers and punctuation chosen by a user are often easily guessed by an attacker using a cracking dictionary of just a few hundred thousand words.

Many websites adhere to the principles of randomness, but don’t supervise the results. People can’t remember “Q*!f7aRd^&23,” so they come up with variations that technically comply with the rules but are still easy to guess. For example, simple substitutions such as “$” for “s” and “@” for “a” lead to “P@$$w0rd,” which, although technically acceptable, is still a terrible choice for a password.

Fixing the People Problem

The problem, then, has to do with the enforcement of the NIST guidance. The authors of the 2010 report concluded that people are going to opt for passwords that are easy to remember, no matter what the rules are. Easy-to-remember passwords are also easy to guess. The advantage of long strings of common words over random letters and characters is that they are somewhat easier to remember — that is, if you can call “dogbarnheliumsynchronousbudget” easy.

The authors scolded website operators for making it too easy for users to select passwords that technically comply with rules but aren’t secure. They recommended that password selection be an interactive process in which the authentication engine on the website suggests secure alternatives to the choices users make. Entropy could have value in that scenario, as long as algorithms are involved.

A good solution is to use a password manager, which generates suggested passwords using truly random combinations of letters, numbers and characters, and stores them so users never have to memorize or write them down. There are plenty of free or inexpensive choices out there that are well worth the modest investment.

Listen to the podcast: ‘Cracken’ Passwords with EvilMog of IBM X-Force Red

More from Endpoint

The Needs of a Modernized SOC for Hybrid Cloud

5 min read - Cybersecurity has made a lot of progress over the last ten years. Improved standards (e.g., MITRE), threat intelligence, processes and technology have significantly helped improve visibility, automate information gathering (SOAR) and many manual tasks. Additionally, new analytics (UEBA/SIEM) and endpoint (EDR) technologies can detect and often stop entire classes of threats. Now we are seeing the emergence of technologies such as attack surface management (ASM), which are starting to help organisations get more proactive and focus their efforts for maximum…

5 min read

X-Force Identifies Vulnerability in IoT Platform

4 min read - The last decade has seen an explosion of IoT devices across a multitude of industries. With that rise has come the need for centralized systems to perform data collection and device management, commonly called IoT Platforms. One such platform, ThingsBoard, was the recent subject of research by IBM Security X-Force. While there has been a lot of discussion around the security of IoT devices themselves, there is far less conversation around the security of the platforms these devices connect with.…

4 min read

X-Force Prevents Zero Day from Going Anywhere

8 min read - This blog was made possible through contributions from Fred Chidsey and Joseph Lozowski. The 2023 X-Force Threat Intelligence Index shows that vulnerability discovery has rapidly increased year-over-year and according to X-Force’s cumulative vulnerability and exploit database, only 3% of vulnerabilities are associated with a zero day. X-Force often observes zero-day exploitation on Internet-facing systems as a vector for initial access however, X-Force has also observed zero-day attacks leveraged by attackers to accomplish their goals and objectives after initial access was…

8 min read

Patch Tuesday -> Exploit Wednesday: Pwning Windows Ancillary Function Driver for WinSock (afd.sys) in 24 Hours

12 min read - ‘Patch Tuesday, Exploit Wednesday’ is an old hacker adage that refers to the weaponization of vulnerabilities the day after monthly security patches become publicly available. As security improves and exploit mitigations become more sophisticated, the amount of research and development required to craft a weaponized exploit has increased. This is especially relevant for memory corruption vulnerabilities.Figure 1 — Exploitation timelineHowever, with the addition of new features (and memory-unsafe C code) in the Windows 11 kernel, ripe new attack surfaces can…

12 min read