History and Evolution of Password Best Practices

Early Password Guidelines: Simplicity and Memorable Patterns

The earlier recommended best practice for passwords often suggested using combinations of words that were easy to remember, including variations in capitalization and numbers. This was based on the idea that users needed to craft passwords they could recall, as the systems of the time didn’t enforce stringent password policies. For example, a password like “CopperGoat55” or “EngorgedDIamond1982” might have been considered secure because it mixed upper and lower case letters, included numbers, and avoided easily guessable patterns like “12345.”

However, over time, it became apparent that these passwords were still susceptible to dictionary and brute-force attacks. Attackers could easily guess words in a password and then attempt various combinations, exploiting the relatively predictable structure of the password (e.g., adding a number at the beginning, middle, or end of a word).

Drawbacks of the Word-Based Approach

The primary flaw in this strategy was its reliance on dictionary words. Even with mixed capitalization and appended numbers, the passwords were still vulnerable to modern attack techniques, such as:

1. Dictionary Attacks: These attacks exploit common words or word combinations by attempting every possibility in a dictionary. Many word-based passwords are vulnerable to this kind of attack, even with added numbers or special characters.

2. Pattern Recognition: Even passwords like “CopperGoat55” and “EngorgedDIamond1982” follow predictable patterns, which modern cracking tools can exploit. Once an attacker identifies the format of the password, they can guess variations rapidly, significantly reducing the time needed to crack the password.

3. Password Guessing Based on Personal Information: Many users still tend to use words or combinations related to personal experiences, names, favorite animals, or hobbies. This makes the passwords easier to guess for an attacker who might have access to personal information through social media or other sources.

The Shift to Stronger, Randomized Passwords

In response to the flaws with word-based passwords, the modern best practice shifted toward completely random passwords composed of a mix of characters. The goal was to make the password as unpredictable and complex as possible, using a combination of:

• Uppercase and lowercase letters
• Numbers
• Special characters (e.g., @, #, !)

Passwords like “Gr#9@Tkw2bQ!” are much harder to crack because they do not form recognizable words or follow patterns that can be easily guessed. This shift took place as systems improved their security features and password policies began enforcing minimum requirements for password strength.

The advent of stronger encryption methods and password cracking tools, such as those that utilize brute-force techniques or precomputed “rainbow tables,” highlighted the need for passwords to exceed simplistic, word-based approaches. A password length of at least 12 characters became the baseline recommendation to ensure resistance against brute-force attacks, where every possible combination is tried until the correct one is found.

The evolution of password complexity also coincided with a rise in password managers, which allow users to generate and store long, complex passwords that are difficult to remember. These tools eliminate the need for human-generated, memorable words and ensure passwords are random and unique.

Current Best Practice for Passwords

Use of Random, Complex Passwords

The modern best practice is to use completely random passwords that do not contain recognizable words, and which include a combination of:

• Uppercase and lowercase letters
• Numbers
• Special characters (e.g., @, #, !)

These passwords should be at least 12 characters long, though longer is preferable. The idea is that such passwords are difficult for attackers to guess or crack using brute force or dictionary attacks. For instance, a password like &3VtL$z9!kpq is far more secure than any word-based password, as its unpredictability renders it resistant to common cracking techniques.

Additional Measures to Protect Accounts

While strong passwords are the first line of defense, additional measures can significantly enhance account security:

1. Two-Factor Authentication (2FA) or Multi-Factor Authentication (MFA):

   • 2FA is a security process that requires two forms of verification: something you know (e.g., your password) and something you have (e.g., a smartphone or hardware token). This drastically reduces the likelihood of unauthorized access because even if an attacker acquires your password, they would still need access to the second factor (e.g., a one-time code sent to your phone).
   • MFA extends this by requiring more than two forms of verification, such as biometric data (e.g., fingerprint or face recognition), a security key, or an additional authentication method. The added layers of authentication make it much harder for attackers to compromise accounts.

   It is important to note that while MFA logins can feel tedious due to the additional verification steps, they are an absolute necessity in today’s security landscape. The inconvenience is minimal compared to the potential consequences of a breached account.

2. Recovery Accounts and Backup Methods:

   • Backup Email or Recovery Options: Many services allow you to set up recovery email addresses or phone numbers, which are used to regain access to an account in the event of a forgotten password or a security breach. These should also be secured with strong, unique passwords and, ideally, 2FA.
   • Security Questions: While once a common method for recovering passwords, security questions are now considered weak, especially if the answers can be easily guessed or found through social media. Avoid common questions like “What’s your mother’s maiden name?” and opt for obscure answers or better yet, use an alternative, secure recovery method.

3. Avoid Password Reuse:

   • Password reuse is a significant vulnerability. If an attacker compromises one of your accounts (e.g., through a breach at a service you use), they may attempt to use the same credentials to access other accounts (a practice known as credential stuffing). To protect against this, always use unique passwords for each account.
   • Using a password manager helps ensure unique, complex passwords for each site without the need to remember them all. One such example is Password Genie, a password manager created by the author, which offers both Linux and Windows versions along with the Python source available at GitHub. This tool can assist in securely storing and managing your random, complex passwords, making the process of keeping track of them much easier without the need to remember long strings of characters.

4. Periodic Password Changes:

   • While some organizations may recommend periodic password changes, the focus has shifted to ensuring passwords are strong and unique from the start. However, it is still advisable to periodically update your passwords, especially for critical accounts, and in the event of a breach or suspected security incident. Changing passwords regularly helps limit the risk of unauthorized access, especially when combined with other security measures such as 2FA.

Conclusion

The password best practices have evolved significantly from simple word-based combinations to random, complex passwords. This shift is due to the increasing sophistication of password-cracking tools and techniques, as well as a deeper understanding of security risks. Complementing strong, random passwords with measures like 2FA/MFA, recovery options, and the avoidance of password reuse provides a comprehensive approach to securing online accounts in an increasingly digital world.

While the use of MFA can be seen as tedious, it is crucial to treat it as a necessary inconvenience to protect your sensitive data. Password managers, such as Password Genie, are highly recommended to help track your secure passwords while maintaining strong, unique credentials across all accounts.