Answer
Not much added benefit to strong passwords when yubi (strong mfa) is in place.
But you still have areas where passwords need to be strong and areas where the risk for a weak pw is mitigated by yubi.
Credential Risk-wise
Passwords that grant access over the internet are more risky versus passwords that grant access to local accounts (laptop).
Passwords with mfa are less risky.
Passwords for internal services that you’d use after you connect to the Corp network (ie vpn) are less risky than internet accessible accounts. However, not by much. Most attacks these days get a foothold into your Corp network somehow and you’re better off assuming an attacker is already in.
PW quality matters little when paired with MFA.
Yubi is one of the safest MFA options.
Impact
Some things are more important than others. Example: Servers and infra may always need a yubi vpn, device carts, and passwords.
But, the employee lunch system is less risky (assuming no credit card).
Putting it together
Focus on getting MFA in the right places first.
Buy everyone a pw manager to store their PWs and other secret stuff.
The laptop password should be strong. (It protects the encrypted disk if the device is stolen. )
for Corp stuff - Invest in SSO (not for infra but for Corp stuff). They add protections to detect account takeover to mitigate one PW for lots of stuff
For infra - Get MFA in place too, where you can. Some things though will never get done. Databases, routers, etc. Use a needs based access system like Trustle.com to grant and revoke temp access to important stuff like infra so that no standing privileged permissions exist.
How many passwords
The rule of thumb is to make a unique PW for everything. This is because different authentication systems have different threat models.
Take a laptop versus one password. One password is cloud based and requires a key kept on the device plus a password in the cloud and can enforce rate limits on brute forcing.
A laptop is local and not necessarily tied to a TPM or Secure Enclave so brute forcing is more likely.
Even with a key logger on a laptop - the laptop credential might be stolen but without physical access it is hard to utilize unless the same password is used else where. Meanwhile the one password password wouldnt include the key and is useless from a key logger.
If an attacker gains access in real time to a laptop then given enough time, they can access anything the user can access including one password. That’s where MFA comes into play again.
You’re gut is right
Many passwords force employees to take shortcuts.
When NIST published SP 800-63B, they pulled in research showing when users are required to rotate PWs periodically (every 90 days), that they use predictable passwords. They decided to instead focus on making passwords easier (remove complexity, remove rotation requirements) but to require MFA and verifying the PW isn’t on a known bad pw list like haveibeenpwned.
