Best Password Practices
Based on what we have learnt, here are our recommendations for users and security professionals on how to deal with passwords.
For Users:
-
Use longer passwords: longer passwords of about 12-16 characters and above are much harder to brute force, adding special characters makes it even stronger.
-
Avoid common words: Passwords that are based on dictionary words, with or without spelling alterations, are easily cracked through dictionary attacks.
-
Use passphrases: These are some simple yet complex security features as they are easy to create and memorize but difficult to crack especially if random words are combined. e.g. “horseFridgeJumpMars”
-
Incorporate mixed characters: Use a combination of upper, lower, numbers and symbolization. This combined with longer passwords makes it harder to brute force.
-
Multi-factor authentication (MFA): The main reason for the existence of these additional security layers is to minimize the risk of password-related security breaches – even when passwords themselves are compromised.
-
Use Password managers: This allows you to always have strong passwords without having to remember them.
NIST is an agency of the United States Department of Commerce whose mission is to promote American innovation and industrial competitiveness. Here are their recommendations for passwords.
Password Composition
-
Minimum length — User-generated passwords must be at least 8 characters long and auto-created passwords must be at least 6. Previously, the minimum length for both was 6.
-
Maximum length — Both user-generated and auto-generated passwords must have a maximum length of 64 characters.
-
Password complexity — Previous NIST guidelines required passwords to include special characters and banned certain characters, such as spaces and emojis. Now NIST recommends having no complexity requirements but making any American Standard Code for Information Interchange (ASCII) character permissible.
Password Management
-
Password changes - Previously, NIST password expiration requirements forced users to change their password periodically. However, in light of subsequent research, NIST now recommends requiring users to change their passwords only when there is a specific reason, such as account compromise.
-
Password history - Organizations are encouraged to check a user’s proposed new password against their old ones to ensure sufficient originality.
-
Password checking - NIST requires organizations to check proposed new passwords against a blacklist of prohibited passwords. These password lists may include credentials compromised in previous breaches, dictionary words, passwords containing repetitive or consecutive characters like “12345” or “aaaa”, and context-specific words like the name of the user or the business.
-
Account lockouts - NIST 800-63B recommends that accounts be locked after no fewer than 10 failed log-in attempts.
-
Password storage - NIST requires password hashing and salting to make password-guessing attacks prohibitively costly for adversaries.
-
Password hints - Current NIST password guidelines discourage organizations from allowing password hints (e.g., “What year were you born?”) because they can make it easier for hackers to guess a user’s password.
NIST - National Institute of Standards and Technology
-
Salting passwords make them much harder to crack even if they are simple or common
-
Enable CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart): It works to eliminate automated attacks