Passwords: Problems of complexity requirements, updating your approach
27 Mar 2023
It's well-known that enforcing password complexity requirements is a poor defence against guessing attacks. Our minds will always struggle to remember random character strings and therefore we use predictable patterns, which includes replacing the letter ‘o’ with a zero to meet the required 'complexity' criteria.
Attackers are so familiar with these strategies and use this knowledge again and again to optimise their attacks. Enforcing complex password requirements becomes a counter-intuitive process and all users do is create even more simple and predictable passwords.
The recent NCSC UK Cyber Security Survey results highlights:
• Less than half do not always use a strong, separate password for their main email account
• 70% always use PINs and passwords for smart phones and tablets
• Only 15% say they know a great deal about how to protect themselves from harmful activity
• 89% use the internet to make online purchases – with 39% on a weekly basis
• The most regular concern is money being stolen – with 42% feeling it likely to happen by end of 2023
Making serious considerations to your password’s usage both personally and in your organisation should be a priority.
Hacked passwords
The NCSC has also published separate analysis of the 100,000 most commonly re-occurring passwords that have been accessed by third parties in global cyber breaches. Password re-use is a major risk that can be avoided, e.g., nobody should protect their personal or business data with something that can be guessed, like their first name, local football team or favourite band.
When users and employees are faced with making yet another password with specific requirements, users simply fall back on variations of something they already know and use. This is dangerous as it falsely allows the users or employees in to believing it to be strong because it satisfies password strength meters (and in general, is accepted by online services).
Longstanding (and very poor) generic advice that passwords must be memorised and storing them in any way in a password manager, a browser, or on a piece of paper is still too risky. The continued low uptake of password managers to both store and generate passwords (the NCSC has encouraged organisations and individuals to use password managers for some time now).
To be clear, there are several ways you can securely store your passwords, in a password manager, a browser, or on a piece of paper, so remembering them is no longer a problem. Cyber breaches can cause huge financial and emotional heartache through theft or loss of data which we should all endeavour to prevent.
Three random words
We’ve established that the traditional password advice built around 'password complexity' failed because it told us to do things that most of us simply can't do e.g., memorise lots of long, complex passwords. Passwords generated from three random words can help users to create unique passwords that are strong enough for many purposes. These passwords can also be remembered much more easily.
Benefits of three random words include:
• Length - Passwords made from multiple words will generally be longer than passwords made from a single word. Length is the common and most recommended requirement for passwords and promoting the use of a 'passphrase' created by combining words provides a way to achieve this without relying on predictable patterns. E.g., the addition of ! at the end of a password.
• Impact - 'Three random words' contains all the essential information in the title, and can be quickly explained, even to those who don't consider themselves computer experts and user adoption is critical.
• Novelty - The stereotypical password is a single dictionary word or name, with predictable character replacements. This format encourages a range of passwords that most users have not previously considered.
• Usability - The main issue with enforcing complexity requirements is that it's difficult for users to generate, remember, and enter complex passwords correctly without substantial effort. However, according to the NCSC, ‘Three random words' power is in its usability, because security that's not usable doesn't work.
Some organisations system owners may have concerns using the three random words technique over others. One consideration is it may not be necessary across all organisations. E.g., some organisations will already be using good strategies for creating strong, unique passwords, and others will be uncomfortable moving to a model that's so different from what they currently use. However, if you're not using 'three random words' then you may want to consider adopting it or read our article on password strategies that can help your business remain secure for further advice and tips.
Visit SecurityWise
Source: SecurityWise