Many sites demand a capital letter, a digit and a special character, on the assumption that complexity equals strength. To find out, fifteen kinds of password rules were tested on more than twenty thousand participants, for strength and for convenience alike. Which won?
Rules built around length. These were born of reasonable logic, and they can push people toward predictable patterns, such as an exclamation mark at the end. Across 15 and more than 20,000 participants, policies focused on length produced both good and an easier experience than several common complexity rules.
The authors compared 15 policies differing in length requirements, in character restrictions and in complexity rules. Two large tests combined strength measures with usability tasks.
They found the tension between security and convenience is not inevitable. Some of the rules that led to stronger passwords were also easier to live with than a common rule piling up several mixing requirements.
A length rule allows more possibilities without forcing everyone into precisely the same shape. But a long run of common words can be predictable too, if it is lifted from a familiar phrase, and a password per service remains a separate requirement.
Modern systems add filters for leaked passwords and multi-factor authentication. This work teaches how to design requirements, and it does not suggest giving up the other layers of protection.
wat. More demands for special characters do not guarantee more safety; sometimes a usable length requirement does the better job.
wat wat
A good security rule should help a person create a password that is hard to guess without pushing them into a predictable pattern or onto a note beside the computer.
How do we know?
Two online experiments measured the strength and the usability of 15 different policies among more than 20,000 participants.
What is still unknown
Attack and usage patterns have changed since 2016. These experiments alone did not test every modern authentication system or the extra protection of multi-factor authentication.
Learn something?
Where to next
Which wall of lava lamps is guarding part of the internet?security
Is virtual reality really an “empathy machine”?technology
Can a message tell you it was intercepted?security