Steve Gibson (44:02)
That's all of our longtime listeners will recall about 13 years ago. Back in 2012, after spending some time on the podcast examining and sharing the details of what was then modern password cracking using high speed hardware assisted hashing systems, I hit upon the idea that a password's length was far more important to its provision of cracking resistance than its complexity. The idea was that if some hashing system was going to be trying every possible password of a certain minimum assumed length, and then increase its guest length by one after exhausting all possible passwords of that initial length, and so on until it succeeded, then the easiest means of preventing this form of password cracking would simply be to use longer passwords so that anyone attempting to brute force crack the password would give up long before they reached a password of the length you had chosen. The essential revelation was that if all possible passwords were going to be checked, it made no difference what characters those passwords contained, since they would all be checked eventually anyway. The only thing that mattered was the password's length. This could be summed up in the time honored way Size Does Matter. Searching for a name for this concept, someone in GRC's newsgroups suggested the proverbial needle in the haystack, which I loved. And of course we coined that password Haystacks on the web page that I created. That page has helped people appreciate the power of the math behind the idea that longer passwords will take much longer to crack. And that was 9.3 million visits ago. So that page has been quite popular and hundreds of people visited every day. I'm mentioning this today because although it took 13 years for NIST, the US National Institute of Standards and Technology, to catch up with this idea, they finally have Friday before last, Malwarebytes picked up on this news with their headline, your passwords don't need so many Fiddly characters, NIST says Malwarebytes wrote, it's once again time to change your passwords. But if one government agency has its way, this might be the very last time you do it. Nearly four Years of Work to update and modernize its Guidance for how Talk about Bureaucracy after nearly four years of work to update and modernize its guidance for how companies, organizations, and businesses should protect their systems and their employees, the US National Institute of Standards and Technology has released its latest guidelines for password creation, and it comes with some serious changes. Gone, they write, are the days of resetting your and your employees passwords, and every month or so. And no longer should you or your small business worry about requiring special characters, numbers, and capital letters when creating those passwords. Further password hints and basic security questions are no longer suitable means of password recovery, and password length, above all other factors, they write, is the most meaningful measure of strength. The newly published rules will not only change the security best practices at government agencies, they will also influence the many industries that are subject to regulatory compliance, as several data protection laws require that organizations employ modern security standards on an evolving basis. In short, here's what NIST has included in its updated guidelines. They have six points, six bullet points Password Complexity Special characters Numbers is out. Password length is in as it has been for for years, they said. Regularly scheduled password resets are out. Password resets used strictly as a response to a security breach are in. Yes, basic. Yes, basic Security questions and hints for password recovery are out. Password recovery links and authentication codes are in. They said the guidelines are not mandatory for everyday businesses and and so there's no deadline to work against. But small businesses should heed the guidelines as probably the strongest and simplest best practices they can quickly adopt to protect themselves and their employees from hackers, thieves and online scammers. In fact, according to Verizon's 2025 data breach investigations Report, credential abuse, which includes theft and brute force attacks against passwords, is still the most common vector in small business breaches. And I wonder if that includes phishing, because technically you know, you get somebody's credential through phishing them. But anyway, Malwarebytes then went on into some additional detail which I'm going to share because it was interesting and relevant. So they said here's what some of NIST's guidelines mean from for password security and management, just to be clear. So first, the longer the password, the stronger the defense, they wrote. Password length is a primary factor in characterizing password strength, which of course is the point that the passwords haystack page has been making for 13 years, they wrote, NIST said in its new guidance. But exactly how long a password should should be will depend on its use. If a password can be used as the only form of authentication, meaning that an employee doesn't need to also send a one time passcode or to confirm their login through a separate app on a smartphone, then those passwords should be at a minimum 15 characters in length. If a password is just one piece of a multi factor authentication setup, then passwords can be as few as eight characters. Also, employees should be able to create passwords as long as, wait for it, 64 characters. Yikes. Number two less emphasis on complexity requiring employees to use special characters Ampersand, tilde, percent sign, number sign, so forth numbers and capital letters does not lead to increased security, NIST said. Instead, it just leads to predictable bad passwords. Quote A user who might have chosen password as their password would be relatively likely to choose password and followed by the numeral 1 if required to include an uppercase character oh, lowercase, uppercase p password and a1 on the end if required to include an uppercase letter and a number or uppercase P password1exclamation point if a symbol is also required, the agency said. Since users password choices are often predictable, attackers are likely to guess passwords that have previously proven successful. In response, organizations should change any rules that required password complexity and instead set up rules that favor password length. Third, no more regularly scheduled password resets, they wrote. In the mid 2010s it wasn't unusual to learn about an office that that changed its WI Fi password. Oh gosh, every week now. Yeah, right. You know, go to the, you know, coffee room or the water cooler to get today's, you know, corporate password written above on the chalkboard.
