Should password recommendations be different for devices, networks, and internet?

Question

I started using a password manager last year and updated nearly all of my internet accounts to super-strong, unique passwords, and that isn't a problem, cause I only access them from web browsers or my phone, which has said password manager installed.

But device level access is a different story. Having super-strong, unique passwords is really annoying and prone to needing to pull out your phone to remember it. (using secure notes to remember the password)

I tried the strong password for windows logon and ended up changing it back to a weak string-digit password after a day.

Due to active directory network access being tied to device logon means that network access is also weak. Thankfully most practice MFA for remote network access so thats good.

Another password that I had to set back to being a weak string-digit is my itunes account due to having to enter it so often at the app store.

With Windows 8 device access being tied to an outlook account, and appstore access being tied to an itunes account, I really don't know how to approach those.

Ideally I would like to both recommend and PRACTICE super-strong internet account passwords, but easily remembered device access passwords.

So I guess my question is, should passwords vary depending on what is being accessed, and if so, whats the best practice for the different types of access?

Answer 1

A good password is a trade-off between several parameters:

• Value of that which is protected (this should condition the effort invested by potential attackers).
• Cost of brute force (this depends a lot on the target, e.g. some will allow offline attacks on a hash value, while others limit attackers to online attacks only, at some maximum server-enforced rate).
• Ease of remembrance.
• Ease of entry (e.g. mixed case/digit passwords are difficult to type efficiently on a smartphone).
• External constraints (minimum size, maximum size, strict and often misguided rules enforced by an overzealous admin...).
• Extent of the password power (e.g. SSO makes passwords applicable to many systems; password reuse too).

Since it is a trade-off, a password will never be generally perfect.

How often you type the password is an important parameter: the more often you type it, the easier it will be to remember it. For a password which is entered on a daily basis, go for a sequence of random letters (chosen uniformly and independently of each other): this will speed up entry because you can reach a very decent entropy level in relatively few characters (with only lowercase letters, 10 characters already get you to 47 bits of entropy).

Answer 2

Access controls need to be proportionate to the risks involved. Best practice does not apply.

Passwords to product forum sites need not be as complex as passwords to banking accounts, for obvious reasons: compromise has limited risk on the product forum site.

The question you need to ask of yourself is, what level of risk are you prepared to endure? If you simply don't care, use the same 4-character password for every account, but I assume that you do care or else you would not have asked.

At one time, people rarely locked their front doors because the risks of break-in were so very low, and the inconvenience of having to carry a key was deemed too high. Now, we don't even think about the inconvenience of carrying keys. It's the same with any new access control. After a while, you get used to it, if you recognize its need.

For my phone, I have the most complex passcode I can generate, because the risk to me is high. The passcode to my iPod is simple, because the risk to me is low.

Controls are chosen based on risk. Let risk be your guide.