Password Complexity vs Length
Long passphrases that are easy to remember are far superior to complex or often changing passwords. Longer than 12 characters is critical to prevent password cracking. Correct horse battery staple is a far better password than Tr0ub4dor&3 or any other complex hard to remember password. 2-factor authentication is also crucial with today's cloud applications.
Password Complexity vs Length
This is a debate as old as computers themselves. The popular choice for the past ten years or so has been to choose a moderate length complex password. Even Microsoft tries to force domain users in default group policies to use a "complex" password. I agree using more characters is generally a good idea, but I recommend a longer password over a complex one. At Security Ideals we crack a lot of passwords for our customers and from our experience, the longer concatenated words or phrases take us longer to crack. The computing horsepower these days is such that even a 7 or 8 character complex password with numbers and symbols doesn't take very long to break. Especially when utilizing cloud computing platforms with GPU based cracking techniques.
Users are less likely to write the password down on a sticky note stuck to their monitor when it's less complex. And a 15 or 16 character password even without symbols is nearly impossible to crack given time and speed constraints.
These are the Golden Rules for Passwords:
- Choose words that won't be in a basic dictionary. If necessary modify words that are. Think "appple" over "apple."
- String multiple words or phrases together with numbers.
- Keep it longer than 12 characters
- Do not post your password requirements online. It makes it infinitely easier for an attacker to tailor an attack to your environment if they know your company's requirements and recommendations.
- Consider your password reset mechanism; many attackers target the reset options because they are simpler than the passwords themselves.
Comic courtesy of xkcd.com
