September 20, 2017 By Paul Gillin 3 min read

Have we been creating passwords the wrong way all along? You might think so, based on the new set of guidelines the National Institute of Standards and Technology (NIST) recently issued about the best password practices.

NIST Special Publication 800-63 is a comprehensive guide to managing digital identity, and its recommendations are widely adopted by organizations of all kinds. The most recent guidelines, which were issued in June, modify a 14-year-old sets of rules for password selection — some would say dramatically.

The original guidance, which was published in 2003, recommended the use of passwords composed of random strings of uppercase and lowercase text mixed with symbols. Passwords like “Q*!f7aRd^&23” thus became the holy grail of authentication. The new guidelines lean instead toward the use of long passwords composed of unrelated words, such as “dogbarnheliumsynchronousbudget.” Such passwords are easier to remember and just as hard to crack as their gibberish counterparts, according to the NIST.

Password Practices Past Their Prime?

The Wall Street Journal recently asked the author of the 2003 guidelines about the changes. Bill Burr, a former NIST manager who has since retired, said he now regrets the advice he put forth 14 years ago, saying the rules were too complicated for people to follow.

But the problem wasn’t the advice — it was people. A careful reading of the new guidelines shows that the NIST’s recommendations on password practices haven’t changed all that much, but they have been expanded to encompass new options.

The original guidelines are based on a concept called password entropy, which is a mathematical equation that evaluates the difficulty of cracking a password. In a 2010 academic report, a team of researchers from Florida State University, Redjack and Cisco IronPort Systems discounted the entropy principle as basically useless where humans are involved. They mined through millions of passwords and determined that a mix of letters, numbers and punctuation chosen by a user are often easily guessed by an attacker using a cracking dictionary of just a few hundred thousand words.

Many websites adhere to the principles of randomness, but don’t supervise the results. People can’t remember “Q*!f7aRd^&23,” so they come up with variations that technically comply with the rules but are still easy to guess. For example, simple substitutions such as “$” for “s” and “@” for “a” lead to “P@$$w0rd,” which, although technically acceptable, is still a terrible choice for a password.

Fixing the People Problem

The problem, then, has to do with the enforcement of the NIST guidance. The authors of the 2010 report concluded that people are going to opt for passwords that are easy to remember, no matter what the rules are. Easy-to-remember passwords are also easy to guess. The advantage of long strings of common words over random letters and characters is that they are somewhat easier to remember — that is, if you can call “dogbarnheliumsynchronousbudget” easy.

The authors scolded website operators for making it too easy for users to select passwords that technically comply with rules but aren’t secure. They recommended that password selection be an interactive process in which the authentication engine on the website suggests secure alternatives to the choices users make. Entropy could have value in that scenario, as long as algorithms are involved.

A good solution is to use a password manager, which generates suggested passwords using truly random combinations of letters, numbers and characters, and stores them so users never have to memorize or write them down. There are plenty of free or inexpensive choices out there that are well worth the modest investment.

Listen to the podcast: ‘Cracken’ Passwords with EvilMog of IBM X-Force Red

More from Endpoint

Unified endpoint management for purpose-based devices

4 min read - As purpose-built devices become increasingly common, the challenges associated with their unique management and security needs are becoming clear. What are purpose-built devices? Most fall under the category of rugged IoT devices typically used outside of an office environment and which often run on a different operating system than typical office devices. Examples include ruggedized tablets and smartphones, handheld scanners and kiosks. Many different industries are utilizing purpose-built devices, including travel and transportation, retail, warehouse and distribution, manufacturing (including automotive)…

Virtual credit card fraud: An old scam reinvented

3 min read - In today's rapidly evolving financial landscape, as banks continue to broaden their range of services and embrace innovative technologies, they find themselves at the forefront of a dual-edged sword. While these advancements promise greater convenience and accessibility for customers, they also inadvertently expose the financial industry to an ever-shifting spectrum of emerging fraud trends. This delicate balance between new offerings and security controls is a key part of the modern banking challenges. In this blog, we explore such an example.…

Endpoint security in the cloud: What you need to know

9 min read - Cloud security is a buzzword in the world of technology these days — but not without good reason. Endpoint security is now one of the major concerns for businesses across the world. With ever-increasing incidents of data thefts and security breaches, it has become essential for companies to use efficient endpoint security for all their endpoints to prevent any loss of data. Security breaches can lead to billions of dollars worth of loss, not to mention the negative press in…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today