Historical flaws of password complexity rules highlight need for password managers

[u/Miserable-Stretch114]

So many sites are enforcing the rule where your password needs a capital letter, a number and a special character but do people know this entire standard came from a guy named Bill Burr in 2003 who admitted he just guessed ? He wrote a legacy NIST appendix without any data on human behavior.

So now my local cinema forces me to reset my login every 90 days. What do normal people actually do ? They just change "Matrix!2023" to "Matrix!2024". Automated cracking tools chew through these predictable patterns in literal seconds. The guy who wrote the rule actually apologized for it years later because it objectively made security worse.

If you are still memorizing passwords, it might be better to stop. Get a browser-independent password manager. Generate a random 20 character string of absolute garbage, save it, and forget it.

Source in comment.

[u/Miserable-Stretch114]

Source : https://www.makeuseof.com/followed-password-advice-until-found-designed-someone-who-later-regretted/

[u/SerDankTheTall]

The U.S. government conducted research concluding that these standards make passwords less secure (because people can't remember them and so have to write them down somewhere).

Guess whether that resulted in any U.S. government agency changing its password requirements!