Return to Question

I saw a recent password question on security.stackexchange "Is the NHS wrong about passwords?" The question is very specific about one organization but from what I've seen the same "known bad" password policies are used in most big organizations.

When I say "known bad password policies", I mean to say most big organizations focus on relatively short (8 to 14 characters) passwords with a focus on requiring minimum number of special characters (upper/lower case, symbols, numbers, etc).

When I say "big organizations", I am not just referring to commercial but non-commercial (i.e. NIST's for example. i'm sure others can come up with other such examples). Now that I think of it ... most linux distros have some sort of default password policy that also is very similar (relatively short passwords but requiring special characters).

Why do the large majority of big organizations have "known bad" password policies?

Obligatory XKCD reference about the same subject:

p.s. another very popular question: XKCD #936: Short complex password, or long dictionary passphrase?

p.p.s. Normally I wouldn't ask such a question but I feel strongly this question needs to be asked and answered. Ever since the XKCD comic came out in 2011) I see people asking about this same subject again and again and again... and all the questions are asking legitimate questions... but they all dance around the "why" part without directly addressing it.

I saw a recent password question on security.stackexchange "Is the NHS wrong about passwords?" The question is very specific about one organization but from what I've seen the same "known bad" password policies are used in most big organizations.

When I say "known bad password policies", I mean to say most big organizations focus on relatively short (8 to 14 characters) passwords with a focus on requiring minimum number of special characters (upper/lower case, symbols, numbers, etc).

When I say "big organizations", I am not just referring to commercial but non-commercial (i.e. NIST's for example. i'm sure others can come up with other such examples). Now that I think of it ... most linux distros have some sort of default password policy that also is very similar (relatively short passwords but requiring special characters).

Why do the large majority of big organizations have "known bad" password policies?

Obligatory XKCD reference about the same subject:

p.s. another very popular question: XKCD #936: Short complex password, or long dictionary passphrase?

p.p.s. Normally I wouldn't ask such a question but I feel strongly this question needs to be asked and answered. Ever since the XKCD comic came out in 2011) I see people asking about this same subject again and again and again... and all the questions are asking legitimate questions... but they all dance around the "why" part without directly addressing it.

I saw a recent password question on security.stackexchange "Is the NHS wrong about passwords?" The question is very specific about one organization but from what I've seen the same "known bad" password policies are used in most big organizations.

When I say "known bad password policies", I mean to say most big organizations focus on relatively short (8 to 14 characters) passwords with a focus on requiring minimum number of special characters (upper/lower case, symbols, numbers, etc).

When I say "big organizations", I am not just referring to commercial but non-commercial (i.e. NIST's for example. i'm sure others can come up with other such examples). Now that I think of it ... most linux distros have some sort of default password policy that also is very similar (relatively short passwords but requiring special characters).

Why do the large majority of big organizations have "known bad" password policies?

Obligatory XKCD reference about the same subject:

p.s. another very popular question: XKCD #936: Short complex password, or long dictionary passphrase?

I saw a recent password question on security.stackexchange "Is the NHS wrong about passwords?" The question is very specific about one organization but from what I've seen the same "known bad" password policies are used in most big organizations.

When I say "known bad password policies", I mean to say most big organizations focus on relatively short (8 to 14 characters) passwords with a focus on requiring minimum number of special characters (upper/lower case, symbols, numbers, etc).

When I say "big organizations", I am not just referring to commercial but non-commercial (i.e. NIST's for example. i'm sure others can come up with other such examples). Now that I think of it ... most linux distros have some sort of default password policy that also is very similar (relatively short passwords but requiring special characters).

Why do the large majority of big organizations have "known bad" password policies?

Obligatory XKCD reference about the same subject:

p.s. another very popular question: XKCD #936: Short complex password, or long dictionary passphrase?

p.p.s. Normally I wouldn't ask such a question but I feel strongly this question needs to be asked and answered. Ever since the XKCD comic came out in 2011) I see people asking about this same subject again and again and again... and all the questions are asking legitimate questions... but they all dance around the "why" part without directly addressing it.

I saw a recent password question on security.stackexchange "Is the NHS wrong about passwords?" The question is very specific about one organization but from what I've seen the same "known bad" password policies are used in most big organizations.

When I say "known bad password policies", I mean to say most big organizations focus on relatively short (8 to 14 characters) passwords with a focus on requiring minimum number of special characters (upper/lower case, symbols, numbers, etc).

When I say "big organizations", I am not just referring to commercial but non-commercial (i.e. NIST's for example. i'm sure others can come up with other such examples). Now that I think of it ... most linux distros have some sort of default password policy that also is very similar (relatively short passwords but requiring special characters).

Why do the large majority of big organizations have "known bad" password policies?

I saw a recent password question on security.stackexchange "Is the NHS wrong about passwords?" The question is very specific about one organization but from what I've seen the same "known bad" password policies are used in most big organizations.

When I say "known bad password policies", I mean to say most big organizations focus on relatively short (8 to 14 characters) passwords with a focus on requiring minimum number of special characters (upper/lower case, symbols, numbers, etc).

When I say "big organizations", I am not just referring to commercial but non-commercial (i.e. NIST's for example. i'm sure others can come up with other such examples). Now that I think of it ... most linux distros have some sort of default password policy that also is very similar (relatively short passwords but requiring special characters).

Why do the large majority of big organizations have "known bad" password policies?

Obligatory XKCD reference about the same subject:

p.s. another very popular question: XKCD #936: Short complex password, or long dictionary passphrase?