Are efforts being made to bring about password standards?

Question

Rather than adopting a universal standard, many websites develop their own guidelines for how passwords should be constructed.

When you consider the number of passwords the average person today has to create and track, this creates problems for those who have a method for constructing and remembering passwords. For instance, some sites actually limit the length of your password to 12 or fewer characters! There are good reasons for enforcing a minimum length, but not to stop a person from using a longer passphrase. 50 characters would be a more reasonable upper limit.

I can understand that certain organizations like the government and the military might want to pursue guidelines that are more stringent than most websites need; however, wouldn't having some universal baseline be practical? Is some organization working to bring this about?

Answer 1

Password strength metres are often wrong in their appreciation of what makes a password good. Often they ask you to pick special characters with little regard for how guessable your produced password is. See Telepathwords for an example of what an informed password strength metre should look like.

For instance, P@s5WorD. is considered very secure by most password strength metres, yet a good password cracking tool will always check for variations of a dictionary word (especially such a popular one as password), which means you haven't moved from an input space of 26 to 95, but rather an input space of 26 + a few tens of permutations per word in that input space. This is simply due to the way humans make passwords; we don't actually create random passwords because we wouldn't remember them.

A lot password research focuses on helping people create more complex passwords, remember longer passwords or even remember passwords by providing an image on the auth UI meant to act as a reminder, which often ignores the fact that people pick short and similar passwords to cope with the number of credentials they are required to deal with. People don't want to select a password based on some secret/hint your UI provides them, or longer or more complex passwords; they want to remember less and fewer passwords because they've had enough! See this paper from Sasse et al. on an authentication study done... on NIST employees. Also, there are some field studies on how many credentials people manage online (for instance the Floriencio and Herley 2007 paper, which is a bit old already; probably people have many more accounts by now).

Once you've realised that, and the fact that (not always encrypted) password databases get stolen on a daily basis (hence the main issue is not password strength but password handling and storage), you start understanding that the issue is most service providers have no clue why they apply a policy and just mimic whatever they see others do... perpuetating unusable and unscalable password requirements and policies over time.

There was an effort in the past to bring about federated identities with services such as OpenID but service providers preferred to retain control over their customers' identities for a handful of reasons, which means more different authentication interfaces and more passwords for users.

There are interesting initiatives out there to replace passwords (see Pico), but I'm afraid you shouldn't expect any industry improvement over night.

Answer 2

There already is one produced by NIST. And there are good reasons to limit a maximum password length.

Also depending on what industry you are in, standards/requirements may already have been defined. For instance PCI-DSS or the Department of Defence. The problem here is that there are multiple standards, there is no single one.

Bounds have to be set, both upper as lower bounds. In case of passwords an example would be PBKDF2-HMAC-SHA1 (provided that users generate their passwords randomly) a commonly used password hashing algorithm. If the password exceeds 64 bytes in length it will be truncated to 20 bytes (by applyibg a SHA-1 hash to the password) as otherwise it would exceed the blocksize. Of course this is still a lot more than 12 characters, but if you initially plan to use a 70 byte long password it will be reduced to 20 bytes as otherwise the algorithm won't be able to work with the password.

Edit:

A more valid example is listed in the comments. No reason to have passwords which are several MB in size as this does not add any security compared to for instance a 1024 character password. Having such a large password could result in unexpected behaviour within the application.

Answer 3

The problem is that you cannot check the strength of a password in the first place. Or more specifically: We can recognize some weak passwords (too short, obvious patterns), but we don't know how a strong password looks like.

Neither the length nor the presence of “special characters” automatically make a password strong. And a relatively short password which only contains alphanumeric characters isn't automatically bad. So any password policy is, at best, a rough attempt at filtering out obvious garbage and making people think about password security.

A universal standard for passwords simply isn't feasible and probably not even sensible. A policy which may work well for one audience may completely fail for a different audience. For example, I mostly generate random passwords with a password manager. Forcing me to follow a certain pattern is nonsensical and annoying. On the other hand, the same policy might actually help somebody with less technical experience. Well, you can't have both. I think the only criterion everybody can agree upon is the minimum length.

Answer 4

In addition to steve's answer, because having any method to the madness in your password makes it vulnerable, the best advice is to make it random and long. How long?

22 seems to be about right if its a random sampling of the 62 character alphabet: a-z, A-Z, 0-9.

And they should be unique from site to site.

But how do I remember all of these random, long, unique garblygoop passwords??? You don't. Use a password manager!