Return to Answer

[ "Why does someone else do something dumb?" is always a very open-ended question subject to speculation (and is not a great fit for Stack Exchange.) But because this problem is so prevalent among password policies, I believe it's worth exploring. ]

[ "Why does someone else do something I consider dumb?" is always a very open-ended question subject to speculation (and is not a great fit for Stack Exchange.) But because this problem is so prevalent among password policies, I believe it's worth exploring. ]

[ "Why does someone else do something dumb?" is always a very open-ended question subject to guessing (and is not a great fit for Stack Exchange.) But because this problem is so prevalent among password policies, I believe it's worth exploring. ]

• Some security experts believe that a combination of special characters, numbers, and mixed case letters automatically make passwords unguessable, but they don't know or disagree what the optimal mix is.
• Some don't understand the massively parallel capabilities available to modern password attackers. Cloud based computing resources, purpose-built arrays of graphics cards, and thousands of botnet controlled computers are all being employed by people to crack passwords. Databases of previously cracked passwords, dictionaries from every language, song lyrics, and movie quotes are all readily available to the enterprising hacker when it comes time to testing guesses.
• People remember hearing things like "don't write passwords down", which was advice from 20 years ago when you could count on the secretary to write her boss's password on a post-it note stuck to her monitor, and the biggest threat was someone could walk by her desk when she was at lunch. I have yet to disassemble a keystroke logger that is able to read a sheet of handwritten paper kept in my wallet.
• And technical people don't help when they toss around terms like "entropy" and numbers like "7 to the 95th power" that mean nothing to an average person; at the same time they ignore the psychology of the average user who doesn't want to enter 12 cryptographically random characters, let alone be asked to remember them for each of a dozen web sites.

Next, good passwords are notoriously difficult to study. If I was asked to enter my work password into a web site so they could study its complexity, I'd say "no", or more likely "[expletive deleted] no". Many studies involving people entering a made-up password don't have test conditions that reliably mimic the real world. So our primary sources of data on user-chosen passwords are the passwords and hashes published after (the increasingly frequent) data breaches. But these are often from sites like "long-eared-rabbit-fanciers-forum.com", where people have little of value to lose from using a weak password. They seem to be less often published from sites where the users are protecting their own credit cards, account balances, or other forms of digital valuables. I'm unaware of any case where a bank's cleartext password database was published online. And in many cases, the published databases are hashed and to analyze them means to brute force attack them with a hashing algorithm before analysis can begin.

There is also education. Web site administrators don't take classes in "choosing a good password complexity scheme," nor do they take classes in "securely storing passwords". And a huge number of computer courses use an example of "create a sign-on screen" as an introductory program; but none of the many examples I've seen have ever demonstrated using pbkdf2() to hash the passwords before placing them in the database. And with all that, if you do come up with effective rules on choosing a good password, you still have to convince users to pick secure passwords instead of settling for 'P@ssword1'.

All that said, there are many researchers who have done a lot of work on passwords. You'll find hundreds of curated scholarly papers on the subject at http://www.passwordresearch.com. There are presentations on passwords at many of the premier security conferences. There is an annual International Conference on Passwords. So there are bodies of knowledge being built up, but they haven't converged on a specific set of conclusions or recommendations yet. And this information has yet to be disseminated to many of the architects and engineers who build web sites. There is simply no straight pipeline of solid information from the researchers into practice. And that may be the biggest hurdle of all.

[ "Why does someone else do something dumb?" is always a very open-ended question subject to speculation (and is not a great fit for Stack Exchange.) But because this problem is so prevalent among password policies, I believe it's worth exploring. ]

• Some security experts believe that a combination of special characters, numbers, and mixed case letters automatically make passwords unguessable, but they don't know or disagree what the optimal mix is. The guidance also should be changed depending on the native language of the users, but many site administrators are unaware of the differences.
• Some don't understand the massively parallel computing resources available to modern password attackers. Hard drives containing rainbow tables of every possible 8 character string hashed with MD5 are sold online. Cloud based computing clusters, purpose-built arrays of graphics cards, and thousands of botnet controlled computers are all being employed by people to crack passwords. Databases of previously cracked passwords, dictionaries from every language, song lyrics, and movie quotes are all readily available to the enterprising hacker when it comes time to testing guesses.
• People remember hearing things like "don't write passwords down", which was advice from 20 years ago when you could count on the secretary to write her boss's password on a post-it note stuck to her monitor, and the biggest threat was someone could walk by her desk when she was at lunch. I have yet to disassemble a keystroke logger that is able to read a sheet of handwritten paper kept in my wallet. But some people still repeat this advice today.
• And technical people don't help when they toss around terms like "entropy" and numbers like "7 to the 95th power" that mean nothing to an average person; at the same time they ignore the psychology of the average user who doesn't want to enter 12 cryptographically random characters, let alone be asked to remember them for each of a dozen web sites.

Next, good passwords are notoriously difficult to study. If asked to enter a work password into a web site so they could study its complexity, most people would say "no". Many studies involving people entering a made-up password don't have test conditions that reliably mimic memorization or usage in the real world. So our primary sources of data on user-chosen passwords are the passwords and hashes published after (the increasingly frequent) data breaches. But these are often from sites like "long-eared-rabbit-fanciers-forum.com", where people know they have little of value to lose from using a weak password. They seem to be less often published from sites where the users are protecting their own credit cards, account balances, or other forms of digital valuables. I'm unaware of any case where a bank's cleartext password database was published online. And in many cases, the published databases are hashed and to analyze them means the researchers have to brute force attack them with a hashing algorithm before analysis can begin.

There is also education. Web site administrators don't take classes in "choosing a good password complexity scheme," nor do they take classes in "securely storing passwords". And a huge number of computer courses use an example of "create a sign-on screen" as an introductory program; but none of the many examples I've seen have ever demonstrated using pbkdf2() to hash the passwords before placing them in the database. And with all that, if you do come up with effective rules on choosing a good password, you still have to convince users to pick secure more passwords than 'P@ssword1'.

All that said, there are many researchers who have done a lot of work on passwords. You'll find hundreds of curated scholarly papers on the subject at http://www.passwordresearch.com. There are presentations on passwords at many of the premier security conferences. There is an annual International Conference on Passwords. So there are bodies of knowledge being built up, but they haven't converged on a standardized set of conclusions or recommendations yet. And this information has yet to be disseminated to many of the architects and engineers who build web sites. There is simply no straight pipeline of solid information from the researchers into practice. And that may be the biggest hurdle of all.

• Some security experts believe that a combination of special characters, numbers, and mixed case letters automatically make passwords unguessable, but they don't know or disagree what the optimal mix is.
• Some don't understand the massively parallel capabilities available to modern password attackers. Cloud based computing resources, purpose-built arrays of graphics cards, and thousands of botnet controlled computers are all being employed by people to crack passwords. Databases of previously cracked passwords, dictionaries from every language, song lyrics, and movie quotes are all readily available to the enterprising hacker when it comes time to testing guesses.
• People remember hearing things like "don't write passwords down", which was advice from 20 years ago when you could count on the secretary to write her boss's password on a post-it note stuck to her monitor, and the biggest threat was someone could walk by her desk when she was at lunch. I have yet to disassemble a keystroke logger that is able to read a sheet of handwritten paper kept in my wallet.
• And technical people don't help when they toss around terms like "entropy" and numbers like "7 to the 95th power" that mean nothing to an average person.

• Some security experts believe that a combination of special characters, numbers, and mixed case letters automatically make passwords unguessable, but they don't know or disagree what the optimal mix is.
• Some don't understand the massively parallel capabilities available to modern password attackers. Cloud based computing resources, purpose-built arrays of graphics cards, and thousands of botnet controlled computers are all being employed by people to crack passwords. Databases of previously cracked passwords, dictionaries from every language, song lyrics, and movie quotes are all readily available to the enterprising hacker when it comes time to testing guesses.
• People remember hearing things like "don't write passwords down", which was advice from 20 years ago when you could count on the secretary to write her boss's password on a post-it note stuck to her monitor, and the biggest threat was someone could walk by her desk when she was at lunch. I have yet to disassemble a keystroke logger that is able to read a sheet of handwritten paper kept in my wallet.
• And technical people don't help when they toss around terms like "entropy" and numbers like "7 to the 95th power" that mean nothing to an average person; at the same time they ignore the psychology of the average user who doesn't want to enter 12 cryptographically random characters, let alone be asked to remember them for each of a dozen web sites.