Password policy

Typical password policy components:

Password length and generation

See also : Password complexity

Many policies require a minimum password length. Eight characters is typical but may not be suitable. ^{[2] [3] [4]} Longer passwords are usually more secure, but some systems set a maximum length for compatibility with legacy systems.

Some policies suggest or impose requirements on the type of password that the user can choose, for example:

• the use of uppercase and lowercase letters ( case sensitivity )
• inclusion of one or several digits
• inclusion of special characters such as @, #, $
• ban words found in the password blacklist
• prohibition of words contained in the user's personal information
• prohibition of the use of company name or abbreviation
• ban passwords matching the date format, car numbers , phone numbers, or other common values

Other systems create a password for users or allow the user to select one of a limited number of displayed options.

Password blacklists

Password blacklists are lists of passwords that are always blocked. Blacklists contain passwords made up of combinations of characters that would otherwise comply with company policies, but should no longer be used because they are considered unsafe for one or more reasons. Typical examples are Password1, Qwerty123, or Qaz123wsx.

Password Expiration

Some policies require the user to change the password periodically, often every 90 or 180 days. However, the benefit of password expiration is controversial. ^{[5] [6]} Systems implementing such policies sometimes do not allow users to choose a password too close to the previous choice. ^[7]

This policy can often be unpleasant. Some users find it hard to come up with “ good ” passwords, which are also easy to remember. Ultimately, due to frequent password changes, users use much weaker combinations of valid characters; The policy also encourages users to record passwords. In addition, the policy prohibits the user from repeating the last password, which implies the need for a database of all the latest passwords (or their hashes ). Finally, users can change their password several times in a few minutes, and then return to the one they really want to use, bypassing the password change policy completely.

It is also worth considering the human factor. Unlike computers, users cannot delete one memory and replace it with another. Therefore, often changing a stored password is a burden on human memory, and most users resort to choosing a password that is relatively easy to guess. Users are often encouraged to use mnemonic rules to remember complex passwords. However, if the password needs to be changed again, the mnemonics are useless because the user will not remember which mnemonics to use. In addition, the use of mnemonics (leading to passwords such as "2BOrNot2B") makes password guessing easier.

Administration factors may also be an issue. Users sometimes have older devices that require a password that was used before the password expired. In order to manage these old devices, users may have to resort to recording all old passwords in case they need to log into the old device.

It is often better to require a very strong password and not require a password change. ^[8] However, this approach has a significant drawback: if an unauthorized person receives a password and uses it without being discovered.

These factors need to be weighed: the likelihood that someone will guess the password because it is weak compared to the likelihood that someone will be able to steal or otherwise obtain, without guessing, a stronger password.

Bruce Schneier claims that “almost everything that can be remembered can be hacked,” and recommends a scheme that uses passwords that will not be displayed in any dictionaries. ^[9]

Sanctions

Password policies can include progressive sanctions, starting with warnings and ending with a possible loss of computer privileges or shutdown. Where confidentiality is prescribed by law, for example, with state secrets , violating a password policy can be a criminal offense.

The required level of password strength depends, among other things, on how easy it is for an attacker to submit a few guesses. Some systems limit the number of times a user can enter an incorrect password before a delay is applied or the account is frozen. On the other hand, some systems provide a specially hashed version of the password so that anyone can verify its validity. When this is done, an attacker can try passwords very quickly; so much stronger passwords are necessary for reasonable security. (see password cracking section) More stringent requirements are also suitable for accounts with higher privileges, such as root or system administrator accounts.

Usability Considerations

Password policies typically represent a compromise between theoretical security and the practicality of human behavior. For example:

• Requiring excessively complex passwords and changing them frequently can lead to users writing down passwords in places that would be easy for an attacker to find, for example, in Rolodex or on a paper note next to a computer.
• Users often have dozens of passwords to manage. It may be more realistic to recommend using a single password for all low-security applications, such as reading online newspapers and accessing entertainment websites.
• Similarly, requiring users to never write down their passwords can be unrealistic and lead users to choose weak ones (or cause a lot of inconvenience when users forget their password). Alternatively, you can suggest storing the recorded passwords in a safe place, for example, in a secure or encrypted main file. The validity of this approach depends on the most likely threat. While password logging can be problematic if potential attackers have access to a secure repository, if the threat is primarily remote attackers who do not have access to the repository, this can be a very safe method.
• Enabling special characters can be a problem if the user must log on to a computer in another country. Some special characters are difficult or impossible to find on other language keyboards.
• Some identity management systems allow you to reset your password yourself, where users can bypass password protection by providing answers to one or more security questions, such as “where were you born?”, “What is your favorite movie?” etc. Often the answers to these questions can be obtained through social engineering , phishing, or simple research.

An analysis of the password policies of 75 different websites in 2010 ^[10] concludes that security only partially explains the more stringent policies: exclusive service providers, such as government sites, have more stringent policies than sites where consumers have a choice (for example, retail sites and banks). The study concludes that sites with more stringent policies "do not have major security issues, they are simply better isolated from the consequences of poor use."

Other approaches are available that are generally considered more secure than simple passwords. These include the use of a security token or a one-time password system, such as S / Key , or multi-factor authentication . ^[11] However, these systems reinforce the trade-off between security and convenience: according to Schuman Gosemajumder, all these systems improve security, but come "by transferring the burden to the end user." ^[12]

In June 2017, the U.S. National Institute of Standards and Technology (NIST) released a new revision of its digital authentication guidelines, NIST SP 800-63B-3. ^[13] Compare these principles with the rules for ensuring protection against unauthorized access by the Federal Security Service of the Russian Federation (FSB) ^[14]

The more complex the password policy, the more difficult it is to apply because of the difficulties with remembering or choosing the appropriate password.

Most companies require users to familiarize themselves with the password policy, as the company will require employees to keep abreast of security rules, but it is often difficult to provide an appropriate policy. Many systems, such as Microsoft Windows , which require passwords, have built-in methods for enforcing established policies. This is the only reliable way to enforce this policy.

• Single sign-on technology