Everything You Know About Passwords Is Wrong
summary
Common password rules—short fixed maxima, required character classes, forced 90‑day rotations—actually reduce security; credential stuffing uses breach dumps (average breach ~10,000 accounts) and rented GPU farms doing billions of hashes per second to crack those constrained passwords. Four random words give far more entropy than mixed-case substitutions (example: 28 bits vs ~44 bits), NIST now allows up to 64 characters max and recommends checking against breached password lists. Practical fixes: use 2FA not SMS, rely on password managers and passphrases, avoid forced expiration and monitor logs for compromise.
AI-written summary · about
chapters (7)
- 0:00Start
- 0:43AUTHENTICATION
- 3:23PASSWORD HISTORY
- 15:48PASSWORD SPACE
- 18:44NIST PASSWORD RULES
- 19:27NIST ADDITIONS
- 20:40OUR RECOMMENDATIONS
related talks
14mPasswords. Are. Not. Hard!
23mFantastic Passwords and Where to Find Them
47mYour Password Complexity Requirements are Worthless
01h 05mPasswords are not going away
43mPlease pass the salt: Serve up passwords with a side of entropy
40mFantastic Passwords and Where to Find Them
30mhunter2: A Symphony of Password Horror
46mRequiem for the Password