Originator of web's Password Rules admits he was wrong

The writer of that paper was a man named Bill Burr, (no relation to the comedian), a former manager at NIST. This document somehow made internet passwords – and thereby most computer-based passwords – the needlessly complicated monsters they are today. The rules in question can be found in the NIST document "Digital Identity Guidelines". This is an official government document from the U.S. Department of Commerce.

This document goes through a bunch of ways in which passwords should be chosen – there's a whole bunch of other neat stuff in there about security, too. Back in 2003 in this since-updated document, Burr recommended using complicated passwords with a mix of capital letters, lower-cased letters, non-alphabetic symbols, and numbers. He suggested then that using these characters would make passwords more difficult for malicious agents to guess.

Here in 2017, one of modern hacker's most basic tools – a bruteforce attack – can guess a short password in very little time, regardless of the odd mix of characters it uses. Instead of picking a short password that's difficult to remember, making a long password is best. This is especially true if the password is something unique that only one person would think to type. Human words with letters that make a sentence, for example.A password such as "thisroomsmellsliketerriblefarts" is better than one like "W9ob!R55". Special characters, capitalization, and a mix of letters and numbers do NOT make a password more difficult for a computer to guess, they only make a password harder for humans to remember.

*In August of 2017, these security guidelines have been updated. Included in the document is a much more modern look at how computer access security works in 2017. The document mentions legacy requirements and how the world has changed (since 2003).

"Access authorization to computers and data has traditionally been based on identities authenticated through user selected passwords," said the document. "More recently, cryptographic mechanisms and biometric techniques have been used in physical and logical security applications, replacing or supplementing the traditional identity credentials."

Also in the document is a link to FIPS: Personal Identity Verification (PIV) of Federal Employees and Contractors. This paper is another official US government document, this time part of Federal Information Processing Standards (FIPS). There it is shown (at the time this article was first published) how federal security standards rely on three factors of authentication.

The three main categories of Multifactor Authentication (MFA):• Something you are (example: Fingerprint)• Something you know (example: PIN code)• Something you have (example: Security Card)

While lengthier passwords are best for the average citizen, the federal government recommends multiple forms of authentication for access to any important information both on and off the Internet. Also of note here – these documents are always subject to updates and improvements. As the initial document said at its latest update, "Updates to authentication and assertion requirements to reflect advances in both security technology and threats."