Have we been creating passwords the wrong way all along? You might think so, based on the new set of guidelines the National Institute of Standards and Technology (NIST) recently issued about the best password practices.

NIST Special Publication 800-63 is a comprehensive guide to managing digital identity, and its recommendations are widely adopted by organizations of all kinds. The most recent guidelines, which were issued in June, modify a 14-year-old sets of rules for password selection — some would say dramatically.

The original guidance, which was published in 2003, recommended the use of passwords composed of random strings of uppercase and lowercase text mixed with symbols. Passwords like “Q*!f7aRd^&23” thus became the holy grail of authentication. The new guidelines lean instead toward the use of long passwords composed of unrelated words, such as “dogbarnheliumsynchronousbudget.” Such passwords are easier to remember and just as hard to crack as their gibberish counterparts, according to the NIST.

Password Practices Past Their Prime?

The Wall Street Journal recently asked the author of the 2003 guidelines about the changes. Bill Burr, a former NIST manager who has since retired, said he now regrets the advice he put forth 14 years ago, saying the rules were too complicated for people to follow.

But the problem wasn’t the advice — it was people. A careful reading of the new guidelines shows that the NIST’s recommendations on password practices haven’t changed all that much, but they have been expanded to encompass new options.

The original guidelines are based on a concept called password entropy, which is a mathematical equation that evaluates the difficulty of cracking a password. In a 2010 academic report, a team of researchers from Florida State University, Redjack and Cisco IronPort Systems discounted the entropy principle as basically useless where humans are involved. They mined through millions of passwords and determined that a mix of letters, numbers and punctuation chosen by a user are often easily guessed by an attacker using a cracking dictionary of just a few hundred thousand words.

Many websites adhere to the principles of randomness, but don’t supervise the results. People can’t remember “Q*!f7aRd^&23,” so they come up with variations that technically comply with the rules but are still easy to guess. For example, simple substitutions such as “$” for “s” and “@” for “a” lead to “P@$$w0rd,” which, although technically acceptable, is still a terrible choice for a password.

Fixing the People Problem

The problem, then, has to do with the enforcement of the NIST guidance. The authors of the 2010 report concluded that people are going to opt for passwords that are easy to remember, no matter what the rules are. Easy-to-remember passwords are also easy to guess. The advantage of long strings of common words over random letters and characters is that they are somewhat easier to remember — that is, if you can call “dogbarnheliumsynchronousbudget” easy.

The authors scolded website operators for making it too easy for users to select passwords that technically comply with rules but aren’t secure. They recommended that password selection be an interactive process in which the authentication engine on the website suggests secure alternatives to the choices users make. Entropy could have value in that scenario, as long as algorithms are involved.

A good solution is to use a password manager, which generates suggested passwords using truly random combinations of letters, numbers and characters, and stores them so users never have to memorize or write them down. There are plenty of free or inexpensive choices out there that are well worth the modest investment.

Listen to the podcast: ‘Cracken’ Passwords with EvilMog of IBM X-Force Red