• Home
• /
• Opinion

Passwords can be annoying but make sure they are safe

Data have shown that it is more important to encourage longer passwords than complicated passwords

For years, computer users have been told they should have complicated passwords, including numbers, punctuation marks and other symbols, and upper and lowercase letters. Despite those being hard to remember, people were told not to write their passwords down, and forced to make up new ones quite frequently. Users dutifully complied - by capitalising the first letter of their passwords, adding a "1" or their birth year, or perhaps ending their password with an exclamation point.
Most people couldn't actually remember lots of passwords without writing them down, so instead they reused a small number of passwords over and over again. And when they were required to change their passwords, they incremented that "1" to a "2" or added another exclamation point. These simple steps to deal with complicated passwords are so common that they actually make it easier for attackers.
People who are trying to break into online accounts don't just sit down at a computer and make a few guesses. Many attackers have been able to steal the entire database of passwords from large companies. This has happened to Yahoo, LinkedIn, Adobe, Ashley Madison and many others. The passwords are scrambled for security, so attackers have to make lots of guesses to unscramble them. But computer programs let them make millions or billions of guesses in just a few hours.
They may start by guessing all the most popular passwords and words in the dictionary, then adding "1" to each of these, and then again with every other digit and symbol, and then with the first letter capitalised, and so on. The end result is that all the complicated password policies don't prevent - or even really slow down - cracking of many users' passwords.
Worse, once an attacker guesses a user's password for one account, he will try using that same password on the user's other accounts. All this computing power being applied to cracking passwords means users need to go beyond choosing passwords that are hard for a human to guess. Passwords need to be difficult for a computer to figure out.
People hold many misconceptions about passwords, such as believing that adding a digit or exclamation point to the end of their password will make it much stronger. This problem is widespread enough that we created an online quiz game to help dispel some of these misconceptions.
In addition, our data have shown us that it is more important to encourage longer passwords (at least 12 characters) than complicated passwords. At the same time, we've learned that some users create long passwords that are still predictable - like "passwordpassword" or "xxxxxxxxxxxx."
We also learned that giving people feedback at the moment they're creating new passwords can help. Most often this takes the form of what are called "password meters" - colour-coded signals that indicate whether a person has chosen a weak password or one that's very strong. A password meter provides an opportunity for advice that helps people improve their passwords.
Our research has led us to develop some specific recommendations for choosing passwords that provide good protection. A crucial aid in this process is to use a password manager to generate long, random passwords - and remember them for you.
If you're making your own passwords:
Make your password at least 12 characters, and mix it up with at least two or three different types of characters (lowercase letters, uppercase letters, digits and symbols), put in unpredictable places. Don't put your capital letters at the beginning or your digits or symbols at the end.
Avoid including names of people or pets, places you have lived, sports teams, stuff you like or birth dates. Avoid common phrases (especially anything related to "love" in any language) and song lyrics. Don't use patterns ("abc," "123").
It may be tempting to reuse existing passwords, but don't do it for accounts you care about. You can also protect your account without making the password more complicated by using two-factor authentication when it is offered - it's easier than most people think.
Passwords are an annoying part of online life, but they aren't going away soon. While the password policies of the past decade have caused more user pain than security gain, our research is helping find ways to create passwords that actually work for regular people while keeping us more secure. -The Conversation
Lorrie Cranor is Professor Computer Science and of Engineering & Public Policy, Carnegie Mellon University. Blase Ur is Assistant Professor of Computer Science, University of Chicago