Password Best Practices: Length Over Complexity
Key Points
- The former “complexity + expiration” rules (mix of cases, numbers, symbols, frequent changes) make passwords harder to remember, prompting users to write them down and actually weaken security.
- NIST’s updated guidance shifts focus to password **length**—encouraging long pass‑phrases that are easy to recall but hard to crack—while allowing passwords to remain unchanged indefinitely unless a compromise is detected.
- Password hints displayed on login screens are discouraged because they give unauthenticated attackers useful information.
- Traditional secret‑question password resets are insecure, as answers are often discoverable on social media; instead, organizations should use out‑of‑band methods such as phone calls or SMS for verification.
- Adopting these new practices improves both security posture and user experience compared to the legacy policies.
Full Transcript
# Password Best Practices: Length Over Complexity **Source:** [https://www.youtube.com/watch?v=xUp5S0nBnfc](https://www.youtube.com/watch?v=xUp5S0nBnfc) **Duration:** 00:02:56 ## Summary - The former “complexity + expiration” rules (mix of cases, numbers, symbols, frequent changes) make passwords harder to remember, prompting users to write them down and actually weaken security. - NIST’s updated guidance shifts focus to password **length**—encouraging long pass‑phrases that are easy to recall but hard to crack—while allowing passwords to remain unchanged indefinitely unless a compromise is detected. - Password hints displayed on login screens are discouraged because they give unauthenticated attackers useful information. - Traditional secret‑question password resets are insecure, as answers are often discoverable on social media; instead, organizations should use out‑of‑band methods such as phone calls or SMS for verification. - Adopting these new practices improves both security posture and user experience compared to the legacy policies. ## Sections - [00:00:00](https://www.youtube.com/watch?v=xUp5S0nBnfc&t=0s) **NIST Password Guidance: Length Over Complexity** - The speaker explains that NIST’s latest password recommendations replace complex‑mix rules and frequent expirations with longer passphrases and indefinite lifetimes to improve security. ## Full Transcript
i hate to tell you this but you're
probably doing passwords wrong at least
that's what the national institute of
standards says in the document they
produced a few years ago with password
guidance
that basically says what we've been
doing as an organization with password
strength policies is making security
worse not better
so the old rules let's take a look at
those
it was that there was a formula that you
needed to follow mixture of upper and
lower case characters numbers special
characters things like that
and what that does in combination with
an expiration date is make it so that
users end up with passwords they can't
remember and if they can't remember them
then they have to write them down and if
we make them change them a lot then
they've really got to write them down so
instead of the old rules of a formula
and expiration in fact the new guidance
is
that we should look at at length
length is strength when it comes to
passwords the longer your password the
harder it's going to be to crack and if
you choose something like a pass phrase
something that is something you will
remember maybe even a sentence if you
came up with mary had a little lamb you
can remember that very easily now don't
choose that one because everyone else
will guess it but some phrase like that
is long and hard to crack and easy to
remember
and don't change your password the new
rules say have them last indefinitely
unless there's a particular reason to
change a password leave it in place
because changing them constantly is
causing people to choose bad passwords
and write them down
old rules also said provide hints in
case you can't remember your password
right there on the login screen it might
say something like okay here's a
question to help you remember what your
password is
the new rules say nope no hints because
think about it this way why would we
give a hint to an unauthenticated user
we don't know if it's you or not if
you're the bad guy i don't want to be
making it easier for you to guess what
my password is
and the old rules all relied on secret
questions to reset if i've forgotten my
password and need to come up with a new
one then there's a set of questions that
i'll ask you that presumably only you
would know the answer to
the new rules say
no go out of band for that kind of
connection for that kind of reset in
other words make a phone call make a
text message use some other form of
communication in order to verify that
the user is who they claim to be because
the secret questions turn out not to be
all that secret in fact most of those
answers
that relate to your favorite this or
that or your high school mascot can all
be found on social media
so
old rules lead to more insecure
passwords new rules lead us to a better
user experience and better security
thanks for watching please remember to
like this video and subscribe to this
channel so we can continue to bring you
content that matters to you