The Limits of Expert Advice

It’s somewhat heartening to me to find that the security advice I’ve been giving for the last decade has been pretty good. What I’ve advised for selecting passwords has been:

1. Using upper and lowercase and punctuation is only good because it makes systematic trying of passwords harder by increasing the number of options.
2. There is no empirical evidence that aging passwords for 90 days is more secure than for 120 days or 180 days or even annually.
3. A long password you can remember is better than a short one, especially a short one that you forget.

That’s what the chap who literally wrote the book on passwords has decided, too, as this Wall Street Journal article reports:

Back in 2003, as a midlevel manager at the National Institute of Standards and Technology, Bill Burr was the author of “NIST Special Publication 800-63. Appendix A.” The 8-page primer advised people to protect their accounts by inventing awkward new words rife with obscure characters, capital letters and numbers—and to change them regularly.

The document became a sort of Hammurabi Code of passwords, the go-to guide for federal agencies, universities and large companies looking for a set of password-setting rules to follow.

The problem is the advice ended up largely incorrect, Mr. Burr says. Change your password every 90 days? Most people make minor changes that are easy to guess, he laments. Changing Pa55word!1 to Pa55word!2 doesn’t keep the hackers at bay.

Also off the mark: demanding a letter, number, uppercase letter and special character such as an exclamation point or question mark—a finger-twisting requirement.

“Much of what I did I now regret,” said Mr. Burr, 72 years old, who is now retired.

In June, Special Publication 800-63 got a thorough rewrite, jettisoning the worst of these password commandments. Paul Grassi, an NIST standards-and-technology adviser who led the two-year-long do-over, said the group thought at the outset the document would require only a light edit.

“We ended up starting from scratch,” Mr. Grassi said.

The new guidelines, which are already filtering through to the wider world, drop the password-expiration advice and the requirement for special characters, Mr. Grassi said. Those rules did little for security—they “actually had a negative impact on usability,” he said.

Key problems are that there may be no empirical information and the experts frequently aren’t really experts or at least not experts in the field on which they’re giving advice. Being a mainframe software developer does not make you an authority on security or human behavior.