Tech Made Simple

Hot Topics: How to Fix Bluetooth Pairing Problems | Complete Guide to Facebook Privacy | How to Block Spam Calls | Snapchat Symbol Meaning

We may earn commissions when you buy from links on our site. Why you can trust us.

author photo

New Password Guidelines Make Your Accounts Easier to Secure

by Elizabeth Harper on August 14, 2017

New password guidelines from the National Institute of Standards and Technology suggest the way we've been making passwords isn't as secure as we think. The original set of guidelines was written back in 2003 by Bill Burr, who now regrets much of his advice. His suggestions became the basis for most of today's password requirements, like requiring passwords to be changed frequently and include alphanumeric characters.

But we've learned a lot about computer security since then, and requiring people to make complicated new passwords every 90 days may be making our passwords less secure. Beyond the fact that technology — and password cracking —  has advanced, these guidelines didn't consider how users would react to the requirements. While some of us will go out of our way to create the strongest passwords possible, many of us simply meet the minimum requirements. After all, passwords are already hard to remember and no one wants to make it even harder on themselves.

For example, when we're required to use letters, numbers and special characters in a password, many of us will use simple substitutions. So when our password "password" is rejected, we may just turn it into "P4ssword!" These substitutions are well-known and easily guessed, so they do little to secure our accounts. And when we're required to change our passwords regularly, we're likely to change "P4ssword!" into "P4ssword!1" —  which is, again, an easily guessed substitution. 

The new guidelines stress longer passwords that don't have to be so complicated and should only be changed after a security breach. Here's a rundown of the new requirements:

  • Passwords should be 8 to 64 characters, with the guidelines stating that password length is the biggest contributor to password strength.
  • All ASCII and Unicode characters should be allowed in passwords, but not required. As we mentioned, requiring such characters simply encourages simple substitutions that don't make passwords stronger.
  • Certain passwords should be forbidden, like passwords known to have been previously stolen, simple dictionary words, repetitive or sequential characters (like "aaaaaaaa" or "12345678"), or the name of the service, user, or other account-related information.

This gives you a lot more room to make a password that can be easy for you to remember, but hard for others to guess. Under these guidelines, a phrase could make for an excellent password — even if it just uses simple dictionary words,  the combination of words and length of the password would make it tough for hackers to crack.

Unfortunately, just because these new guidelines have been released doesn't mean the services that require passwords are going to start following them. Until the internet catches up with these standards, you're stuck creating complicated passwords. Still, that doesn't mean they need to be weak passwords: you can follow the NIST's guidelines on your own and use a password manager to help you keep track of your passwords.

[Image credit: change password via BigStockPhoto]


Topics

News, Computers and Software, Computer Safety & Support, Blog, Privacy


Discussion loading

gravatar

From richard firth on August 22, 2019 :: 10:43 pm


Please advise what I can do - hotmail advice would not let me change anything - it promised to send a “code” but didn’t - can you please advise how I can cancel the current hotmail account and once that’s safely done start again, maybe with a different provider?

I’m in a pickle, help please!

Many thanks,

Richard Firth.

Reply

Home | About | Meet the Team | Contact Us
Media Kit | Newsletter Sponsorships | Licensing & Permissions
Accessibility Statement
Terms of Use | Privacy & Cookie Policy

Techlicious participates in affiliate programs, including the Amazon Services LLC Associates Program, which provide a small commission from some, but not all, of the "click-thru to buy" links contained in our articles. These click-thru links are determined after the article has been written, based on price and product availability — the commissions do not impact our choice of recommended product, nor the price you pay. When you use these links, you help support our ongoing editorial mission to provide you with the best product recommendations.

© Techlicious LLC.