Which password is better?

A reader has a question about passwords:

“Regarding passwords which is better a complex password with numbers, letters(lower and caps) and symbols or a long password such as a sentence Cyn Mackley newsletter is one of the 5 most useful I have seen!”

Well, I gotta say that I really dig your sentence there! The current thinking is that longer is better for a couple of reasons.

The guy who originally came up with the standard of mixing letters, numbers, and irregular characters has changed his mind about the whole thing.

Bill Burr came up with these rules almost 20 years ago while working for the National Institute of Standards and Technology. It turns out that since these passwords are harder to remember, people tend to go for the simple ones. Plus, when they change them, they often only change one or two characters. Also knowing that a site requires one capital letter and one special character can tip hackers off when guessing a password.

Most hackers aren’t trying to guess your password manually. They’re using a program that generates combinations of letters and numbers, trying everyone that’s available. So you end up with passwords that people have problems remembering, but computers can guess pretty easily.

So what are the new rules?
1.No more changing passwords every month or two.
2.Get rid of requirements for upper/lower case letters, numbers, and special characters
3.Create a password up to 64 characters in length. An uncommon phrase familiar only to you is a good choice. Example: “auntsallylovesgreentomatopicklesbutonlyinseasonwithhomemadebread”
4.Check all passwords against lists of frequently used passwords or passwords that have been compromised. Click here to visit PWNED PasswordsClick here to visit PWNED Passwords. This site will let you know if your password has been used in any data breaches.

Of course, the catch is that many sites are still following his old rules and you can only create passwords based on what the particular program or website will allow.  And honestly, more passwords are exposed by companies and websites having poor cyber-security practices than by users having weak passwords. That’s why it’s important to enable two-factor authentication if it’s available. That means there’s an additional step involved besides just entering your password. You may need to answer a question or enter a code send to your phone. If a hacker manages to crack your password, at least you’ve got another line of defense.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.