Passwords · Brennenstuhl on Security

What should a password policy require?

Tue, 13 Oct 2026 00:00:00 +0200

Short answer: Under NIST SP 800-63B-4, a password used on its own must have at least 15 characters, or 8 when it is one factor of multi-factor authentication, and systems should accept at least 64. Composition rules, forced periodic changes, hints and security questions are out; a blocklist of common and breached passwords is in.

Key findings #

NIST SP 800-63B-4 requires passwords used as the only authentication factor to be at least 15 characters long, and at least 8 when the password is used only as part of multi-factor authentication.

Source: NIST SP 800-63B-4, Section 3.1.1.2

Link to this finding Save as image (PNG, 1200 by 630 pixels)

Verifiers shall not impose composition rules such as mixing character types, and shall not require periodic password changes, but shall force a change when there is evidence of compromise.

Source: NIST SP 800-63B-4, Section 3.1.1.2

Link to this finding Save as image (PNG, 1200 by 630 pixels)

A new password shall be compared in full against a blocklist of commonly used, expected or compromised passwords, and a rejected user shall be told why.

Source: NIST SP 800-63B-4, Section 3.1.1.2

Link to this finding Save as image (PNG, 1200 by 630 pixels)

Verifiers shall allow password managers and autofill, should permit paste, and should accept passwords of at least 64 characters.

Source: NIST SP 800-63B-4, Section 3.1.1.2

Link to this finding Save as image (PNG, 1200 by 630 pixels)

Evidence #

Sources
Study	Year	Sample	Method	Finding
NIST SP 800-63B-4: Digital Identity Guidelines, Authentication and Authenticator ManagementNIST	2025	n/a	Standard	Section 3.1.1.2 sets the password verifier requirements summarized here.
SP 800-63B-4 Appendix A: Strength of PasswordsNIST	2025	n/a	Informative appendix	Explains why length and blocklists matter more than composition rules.

What to do #

For engineers #

Set the minimum by how the password is used: 15 characters where it is the only factor, 8 only where a second factor is always required.
Accept long passwords and verify them in full; the essay on long password support covers hashing limits and denial-of-service concerns.
Replace composition rules with a blocklist check against breached and common passwords. The field-guide entry on stolen credentials covers privacy-preserving breach checks.
Make forms work with password managers: the right autocomplete values and no paste blocking. See password-manager friendly login forms.

For product and UX #

Explain a rejection in plain words (“this password appears in known breaches”) instead of listing rules after the fact. NIST requires a reason.
Drop scheduled password expiry. Forced changes are for evidence of compromise, which makes them rarer and easier to explain.
My 2023 password policy essay recommended at least 12 characters. For passwords used on their own, the final SP 800-63B-4 now sets 15.

Check your policy #

Compare a policy with SP 800-63B-4

The checker on this page compares the settings of a password policy with the requirements below. Without JavaScript, use the list as a checklist. “Shall” is a requirement, “should” a recommendation.

Shall: at least 15 characters for single-factor passwords; at least 8 if the password is only one factor of MFA.
Should: accept at least 64 characters, all printing ASCII characters, the space character and Unicode; count each Unicode code point as one character.
Shall not: impose composition rules, such as requiring digits, symbols or mixed case.
Shall not: require periodic password changes. Shall: force a change when there is evidence of compromise.
Shall not: offer password hints to unauthenticated users, or prompt for security questions when a password is chosen.
Shall: verify the whole password, never a truncated or partial one.
Shall: check new passwords against a blocklist, and tell the user why a password was rejected.
Shall: rate-limit failed authentication attempts.
Shall: allow password managers and autofill. Should: allow paste and offer to show the password.
Shall: store passwords salted and hashed with a suitable password hashing scheme, with a salt of at least 32 bits.

Password Attack Guide: What is Password Spraying?

Thu, 11 May 2023 00:00:00 +0200

Introduction to Password Attacks #

Cybercriminals continuously seek new ways to gain account access and exploit security flaws as technology progresses. Password spraying is one such practice that, in recent years, has become popular among hackers looking to gain unauthorized access to accounts and sensitive information. But what exactly is password spraying, how does it work, and what can you do to prevent it? Let’s get started.

What is Password Spraying? #

Password spraying is a well-defined (T1110.003) password attack in which hackers test several commonly utilized passwords to gain access to several user accounts. Malicious actors frequently prepare spraying attacks with reconnaissance and discovery techniques to learn more about the targeted account base. Often online services leak information in their sign-up or password reset processes. Password spraying then concentrates on trying common passwords across many known accounts.

The motivation behind password spraying attacks #

As the cyber threat landscape evolves, threat actors’ focus shifts from assaulting computer networks to stealing user identities. Because of the increasing sophistication of software in detecting malware programs and vulnerabilities, attackers have been forced to adapt, resulting in a greater emphasis on identity-based attacks.

Many organizations invest considerably in securing user accounts by establishing complicated password policies and restricting access to resources from secure networks. While these precautions are vital best practices, they are frequently insufficient in the face of a compromised trusted user account.

How Password Spraying Works #

Understanding a typical password spray attack is critical to protect against and investigate it. Password spray attacks are brute-force attacks that use an exhaustive list of usernames and link them with popular passwords to guess the proper combination for as many passwords and users as possible.

Advanced password spraying involves techniques that rely on people using variations of common passwords and often follow three key characteristics: multiple account targeting, common passwords and wordlists, and other dictionary attacks while flying low and slow under the radar.

Targeting Multiple Accounts #

In a password-spraying attack, attackers target many accounts instead of focusing on one password or a single account. They avoid activating security measures such as account lockout policies or active blocking by spreading their efforts over numerous accounts.

Common Passwords & Dictionary Attack #

Attackers employ lists of common passwords or customized dictionaries, pre-compiled lists of words, phrases, and character combinations likely to be used as passwords. These lists are frequently based on leaked password databases, increasing the likelihood that an attacker would find a match. The password top lists by OWASP are likely the most popular sources for common passwords.

The Use of Bots & Automation in Password Spraying #

A determined malicious actor has to be patient. The most sophisticated password sprays will employ multiple IP addresses and not uncommonly involve botnets to simultaneously assault various accounts with a limited number of selected password guesses. Numerous password-spraying tools exist that help even less techy threat actors to automate brute-force attacks and password-spraying for multiple targets, protocols, and use cases. Due to their highly distributed and low frequent (“dripping”) characteristics, these credential-based attacks are hard to distinguish from natural authentication attempts and often remain undetected.

Password Spraying vs Brute-Force Attack #

Password spraying is a type of brute-force attack. Both seek to guess passwords and identify matching user credentials; the primary distinction is how they do it. Traditional brute-force attacks target a single account and attempt all potential password combinations. This can take time and may result in account lockouts or security alerts. Password spraying, on the other hand, distributes the risk by targeting several accounts with fewer password attempts, making it harder to detect and more likely to succeed, especially given that many regular users reuse commonly used passwords across multiple sites. A password-spraying attack is a brute-force attack on steroids.

Password Spraying vs Credential Stuffing #

Password spraying and credential stuffing are two different credential-based attacks used by attackers to exploit password vulnerabilities. Credential stuffing is a technique in which an attacker obtains a list of leaked credential pairs (username and password) from a prior data breach and attempts to use the same credentials against several accounts hoping to gain access to a valid account. Credential stuffing takes advantage of a list of known credential combinations, and many end-users reuse the same password across many accounts, which is more effective than password spraying. The dark web is full of more or less reliable stolen credentials.

Password Spraying vs Dictionary Attack #

A dictionary attack is a brute force attack in which an attacker generates a password list by combining various words and phrases from a dictionary, hence the name “dictionary” brute force attack. While dictionary attacks and password spraying target passwords, their goals and methods differ. Dictionary attacks seek to exhaust all possible password combinations, whereas a password spraying attack aims to discover a common password used by numerous users. In both cases, attackers are hunting for easy-to-guess or regularly used passwords.

Real-World Examples of Password Spraying #

Password spraying attacks never stop. The following three real-world examples of security incidents caused by password spraying attacks are just the tip of the iceberg:

Microsoft Office 365 Attack – In 2021, Microsoft observed a spike in password-spraying assaults against 250 Office 365 customers in the US and Israeli defense technology sectors. According to Microsoft, the credential-based attacks targeted critical infrastructure businesses in the Persian Gulf and were conducted by a group known as DEV-0343.
Parliament of the United Kingdom Attack – In June 2017, a password-spraying attack targeted the email accounts of members of the UK Parliament, resulting in remote access being blocked for MPs as a precaution.
Citrix Systems Attack – Between 2018 and 2019, hackers accessed Citrix systems and sensitive data over five months. The FBI alerted Citrix to the breach in March 2019 and stated that a password-spraying attack was the likely cause.

How a Password Spraying Attack Affects Your Customers #

Understanding password spraying risks and compromised security costs heavily depends on local threat scenarios, business contexts, and risk appetite. The most severe consequence of password spraying is often a loss of consumer trust. When a website or email account is compromised, there is no way to protect the customer’s personal information or sensitive data without extra passwordless security measures.

Data Breaches & Identity Theft – Password spraying attacks allow fraudsters to gain unauthorized access to sensitive consumer data such as personal information, financial information, intellectual property, and login credentials. This information can be used to commit identity theft or resell on the dark web, placing your clients at risk of financial loss and long-term damage to e.g. their credit ratings.
Loss of Trust – Customers provide businesses their personal information, expecting to be kept safe and secure. A compromised account caused by a password spraying attack can cause users to lose trust in your brand, resulting in decreased customer loyalty and potential loss of business.
Disrupted Services – Credential-based attacks might cause your services to be unavailable, inconveniencing customers that rely on them. Downtime caused by an attack and active countermeasures might make it difficult for your consumers to access their accounts, make purchases, or use your services, leading to irritation and dissatisfaction.
Financial Impact – If an attack is successful, customers may experience economic consequences due to unlawful transactions, fraudulent charges, or the cost of mitigating the effects of identity theft. These financial obligations can diminish the perceived value of your products or services, driving away customers.
Privacy Concerns – When customers discover that their personal information has been exposed due to a password spraying attack, they may become more concerned about their overall privacy and be less willing to share information with a business in the future.

Detecting password spraying attacks #

The most critical exercise to enable effective password spray defense is to monitor and respond to suspicious activity by leveraging tools for detecting password spraying.

Examine account authentication attempts regularly and automatically to spot any failed logins or suspicious patterns. A high ratio of failed login attempts for different accounts in a short period could indicate an ongoing password-spraying attack.

Unusual Account Activity #

Organizations vulnerable to spraying and other credential-based attacks should create user profiles for their accounts and overarching population profiles for their whole account base to discover login abnormalities. User profiles can assist in signaling suspected account activity coming from unexpected IP addresses, utilizing unique user agent identifiers, or other criteria by scoring the originality of an authentication attempt based on prior interaction data. If a user has previously successfully authenticated from a German IP using an iOS user agent, authentications for the same account from an Android smartphone in India should be noticed, considered malicious traffic, and (ideally) trigger additional authentication steps.

Population profiles are comparable but have a broader scope because they consider metadata such as location profiles, network profiles, and device information used throughout the customer base. If an organization’s business plan, for example, restricts service offers to specific users or regions, login attempts from other locations may result in a higher risk score. A company that only operates in Europe will most certainly flag sign-ins from China, resulting in additional actions or limited privileges.

Password spraying prevention #

There are plenty of password spraying defense techniques and best practices available. The most effective threat mitigation is the abandonment of password-based authentication systems (knowledge factor) in favor of passwordless mechanisms. Because this is not currently practicable for many organizations, defense with multiple layers and reinforced authentication approaches is required.

IP-Blocking & Geo-Blocking #

When preventing password spraying or distributed denial of service (DDoS), the ultimate last resort is to hard block individual IPs, entire CIDR ranges, ASNs, or regions. Of course, this will have a significant business impact and will only temporarily alleviate the pressure.

Bot Management #

Because password spraying attacks frequently use automation tooling and large-scale botnets, automated bot recognition and management are critical for password spraying prevention. Because bot detection can not produce binary conclusions or sharp deny decisions, intermediary challenges, and further authentication steps are required.

Intermediary Challenges #

There are at least two types of intermediary challenges: interactive challenges, such as CAPTCHAs, which require users to solve a puzzle to prove human interaction, and non-interactive challenges, such as proof-of-work-based mechanisms, which need a suspicious user agent to solve cryptographic exercises, significantly slowing automated efforts and raising operational costs for large-scale attacks.

Strong Password Policies and Best Practices #

Implementing a firm password policy that encourages complex passwords and prohibits using regularly used passwords and compromised credentials does not necessarily prevent spray attacks. Bad actors will still attempt them, but it renders them virtually ineffective. I recently wrote about how to create a strong password policy that is user-friendly and effective, which you should read!

Passwordless Authentication #

Passwordless authentication is a modern paradigm shift away from knowledge factors (passwords) and toward possession (like Passkeys) or inherence factors (biometrics). Passwordless login is the most effective password-spraying attack prevention because the primary target is removed. I recently described why passwordless sign-in is regarded as the future of cybersecurity; take a look!

Enable Multi-factor Authentication (MFA) #

Two-factor authentication (2FA) and MFA incorporate at least two separate authentication concepts, with the passwordless access component always included. Regular password-based logins are frequently complemented by one-time passwords (OTP) produced in a separate authenticator app or device. Enable MFA to prevent password spraying attacks – many federated authentication providers support 2FA enforcement!

The Ongoing Battle Against Password Attacks #

Password spraying attacks are only one example of how the cybersecurity landscape keeps evolving. As attackers create new strategies, companies and individuals must remain aware and proactive in their security procedures. Brute-force attacks, such as password spraying, can be considerably reduced by setting strong username and password guidelines, establishing multi-factor authentication, and cultivating a security-conscious culture.

Frequently Asked Questions (FAQs) #

Can password spraying be easily detected? #

Because of their low and slow nature, it might be challenging to detect password-spraying attacks. However, organizations can detect and prevent password-spraying attacks with the correct tools and monitoring.

How can I protect my personal accounts from password-spraying attacks? #

To protect your personal accounts from password-spraying attacks, use unique passwords, avoid obvious passwords, enable 2FA, monitor attempts to gain access to your accounts regularly, use password managers, be aware of phishing emails, and keep your security measures up to date.

Are there any tools available to help detect and prevent password spraying? #

Numerous technologies are available to detect and prevent password spraying attacks, like Security Information and Event Management (SIEM) systems, User and Entity Behavior Analytics (UEBA) tools, or dedicated edge protection services. Organizations should employ a combination of these tools and solutions to safeguard their networks and user accounts.

What should I do if I suspect password spraying compromised my account? #

If you suspect your account has been hacked by a password-spraying attack, act quickly to protect your account and personal information. Change your password, apply two-factor authentication, notify the service provider, monitor your potentially compromised accounts, and update your security measures if you see any strange behavior.

Is it Possible to Prevent a Password Spraying Attack? #

While 100% protection against brute-force attacks like credential stuffing or password spray attacks is difficult to ensure, implementing strong password policies, utilizing two-factor authentication, monitoring for suspicious activity, and training users and staff can considerably lower the likelihood of successful attacks.

Passwordless: Critical Notes on FIDO2 Passkeys

Mon, 08 May 2023 00:00:00 +0200

Passkeys are currently on everyone’s lips, thanks to recent announcements to enable Passkeys for authentication on Google accounts. And, while the passwordless hype train did not stop in front of my desk either, there are some problems surrounding the imminent password killer, disregarded mainly by the relatively uncritical media coverage. In this essay, I’ll consider some of the biggest concerns.

I briefly mentioned Passkeys in my recent piece about passwordless authentication, so I’ll keep this introduction brief. Let’s get started!

Introduction to FIDO2 & Passkeys #

The FIDO Alliance developed FIDO2 as an open standard that enables secure and user-friendly passwordless authentication. One of FIDO2’s key goals is to provide passwordless authentication, removing the need for users to remember and manage multiple passwords. Members of the FIDO Alliance include the whole Big Tech ecosystem, from 1Password through Amazon, Apple, Google, Meta, and Microsoft, as well as Yahoo and Yubico.

Phishing-resistant Passwordless Authentication #

The FIDO master plan is to turn every mobile phone into a phishing-resistant, roaming authenticator by augmenting the FIDO WebAuthn specs with a protocol that uses Bluetooth to communicate between the FIDO authenticator (a mobile phone) and the device from which a user is attempting to authenticate. Specialized security keys (hardware tokens like YubiKeys) will be rendered obsolete.

The term “Passkeys” refers to the credentials used in this authentication procedure based on cryptographic concepts. Passkeys for FIDO2 allow users to authenticate themselves without entering a long password, lowering the risk of password-related security breaches.

Public-Key Cryptography #

Unlike many other passwordless login approaches, FIDO2 Passkeys provide a robust authentication mechanism immune to phishing attacks, man-in-the-middle, and replay attacks. This is accomplished through public-key cryptography, a cryptographic technique that employs two keys: a public key and a private key.

Data is encrypted using the public key and decrypted using the private key. In FIDO2 authentication, the private key is securely maintained on the user’s device, while the public key is registered with the online service. The Passkeys protocol defines proof of possession challenges that allow holders of a public key to verify whether the authenticating actor owns the corresponding private key (possession factor). This is a more secure solution than traditional password-based authentication methods (knowledge factor) in most end-user use cases.

Even if your favorite e-commerce site or platform is compromised, malicious actors will only have access to the public component of your key pair, which they will find absolutely useless.

Biometrics #

Now that the most essential authentication proof is stored on a mobile device, FIDO experts anticipate that Big Tech companies will protect access to the private keys as they protect screen lock, with biometric authentication incorporated into the user’s personal device OS. Using Face ID, Touch ID, or any other equivalent facial recognition or fingerprint scanning technology on a Microsoft or Android device to gain access to the valuable private key material, which is then used to sign in with a relying party, effectively results in a multi-factor authentication (MFA) process, combining an inherence factor and a possession factor.

Passkeys Controversies #

Possession & Biometrics over Knowledge #

The most crucial conceptual objective of Passkeys is to shift the broad consumer market away from knowledge-based authentication systems and toward possession-based authentication systems. Although this is undoubtedly a quantum leap forward in account security, far-reaching repercussions may still need to be fully recognized.

For example, something only you know cannot be taken away as quickly as something physical that you own. A secret in someone’s head cannot be found anyplace else and can only be gained from that individual. Of course, there’s blackmailing, “rubber-hose cryptanalysis,” and other methods, but these appear to take much more effort than merely having access to an unlocked cellphone.

Losing that knowledge component makes you more vulnerable to police seizures of electronics and keys, for example. Forcing someone to give up a password is considered a violation of the Fifth Amendment to the United States Constitution by courts in the United States. However, forcing someone to unlock biometrically secured devices is entirely legal. A similar situation might exist in other jurisdictions as well.

While the combination of possession- and inherence factors that FIDO Passkeys promise provides a significant convenience advantage over password-based authentication methods, they appear less effective against close-proximity, physical attacks.

Device Lock-in #

Possession-based systems, in general, rely on tangible items that can be misplaced, stolen, or damaged, potentially locking users out of their accounts.

The FIDO Alliance anticipates that FIDO authenticator providers, particularly influential organizations who embed FIDO authenticators within their operating systems, will make the Passkeys consumer market usable by overcoming the difficulty of making FIDO credentials multi-device available.

Of course, for all of this to function, you’ll need a reliable, modern computer or phone. This means owning a current iPhone, Pixel, or computer that supports Windows Hello, Apple Touch ID, or other biometrics. You also need multiple devices because you are only safe against single device failure if you have a backup device.

Passkeys are likely to be risky to use, if not utterly inaccessible to the poor, underprivileged, or anyone who does not own or operate their own devices.

Vendor Lock-in #

Vendor lock-in shouldn’t be necessary by design, but it may be in reality. Even the FIDO Alliance does not guarantee interoperability when syncing the cryptographic keys of FIDO credentials between devices from different vendors. This is where the additional cross-device authentication Bluetooth protocol comes into play because FIDO believes that users will always have another (backup?) device nearby with all the necessary Passkeys.

This is at least a partial vendor lock-in and disregards the reality of life for many individuals outside of Silicon Valley.

Proprietary-only #

The FIDO Passkey standard deliberately excludes any explicit vendor agnosticism. Implementations still heavily rely on proprietary software embedded into Apple, Google, Microsoft, and others’ devices and solutions. The general strategy results in Big Tech creating and overseeing the key storage. There are no OSS implementations for creating and exchanging keys yet.

As a result, the Passkey concept pushes data ownership one step closer to the Big Tech industry. Taking another vital element of informational self-determination out of the hands of end users by favoring possession- and biometric-based authentication factors over something that is actually available solely to the user is an intentional feature of Passkey rather than a flaw.

100% Trust in Big Tech #

Although FIDO specifies privacy principles that must be followed in designing and implementing FIDO authenticators, clients, and servers, it is still determined how strictly these guiding principles will be enforced and by whom.

The fact that Passkeys is strengthening the need to trust massive tech corporations, whose business model frequently entails selling data and information, is critical. Having FIDO credentials, which basically log end-users into every service they use while vowing not to do evil with them, necessitates some level of trust by the users.

Conclusion #

FIDO2 Passkeys provide a passwordless authentication solution that is secure, user-friendly, and scalable. Unlike passwords, they provide increased protection against common threats and a better user experience for those who can afford it by utilizing public-key cryptography. While there are compelling reasons to join the password-killer bandwagon, and I honestly believe that Passkeys will solve many problems for the general “my password is password” end-user market, there is an undercurrent.

Despite being a multi-national tech industry association, some people see the FIDO Alliance and their Passkeys as another large Silicon Valley solution that doesn’t care about all their users. Potential downsides, such as device dependence, compatibility, and interoperability difficulties, contribute to this debate and should be considered when advocating for FIDO2 Passkeys.

Given the widespread support and work that Big Tech is putting towards modern passwordless authentication, I am confident that adoption rates will skyrocket soon. And some security-conscious individuals will continue to place their stack of unique, complex passwords in a credible password manager with 2FA as a second line of defense rather than a select handful of Big Tech gatekeeping providers.

I advise everyone else to wait until passkeys gain broader support and for the ecosystem to mature before going all-in! Only switch to Passkey-only authentication once you know how it works, how to set it up, and how to back it up.

FAQs #

What is FIDO2? #

The FIDO Alliance created FIDO2, an open standard to enable secure and user-friendly passwordless authentication using public-key cryptography.

How do FIDO2 Passkeys work? #

Upon registration, FIDO2 Passkeys produce a one-of-a-kind public-private key pair on the user’s device. The public key is supplied to the web service, while the private key is kept protected on the device. During authentication, the machine uses its private key to satisfy a cryptographic challenge given by the service, and the service verifies the signature using the stored public key.

What are the benefits of FIDO2 Passkeys? #

FIDO2 Passkeys improve security, user experience, and scalability across various devices, platforms, and services.

What are the potential drawbacks of FIDO2 Passkeys? #

Device dependence, which could result in users losing access to their accounts if their device is lost or broken, and compatibility difficulties, as not all online services offer FIDO2 authentication yet, are potential downsides of FIDO2 Passkeys. Switching from knowledge to possession factors has its own set of issues.

Can I use FIDO2 Passkeys on multiple devices? #

Yes, FIDO2 Passkeys can be used on numerous devices as long as they support FIDO2 authentication and the online service supports multiple device registrations.

Long Password Support for Safer Login Systems

Sat, 06 May 2023 00:00:00 +0200

Strong passwords are necessary for securing user accounts and protecting sensitive data. As a frequent user of authentication systems and principal engineer for a single sign-on solution, I appreciate the necessity of delivering seamless user experience while emphasizing security. In this article, I’ll go over the advantages of long passwords, the obstacles for service providers of supporting them, and how to effectively implement them in your login system.

The Importance of Password Security #

The Rise of Long Passwords #

Passwords serve as the first line of defense in securing user accounts. Longer passwords provide a higher degree of complexity and entropy, making it exponentially more challenging for hackers to crack them. Allowing users and especially their password manager to go wild when creating a unique password for your login system helps to keep their online accounts safe from unauthorized access. Not restricting passwords to an artificially fixed length ensures that your users’ accounts remain more secure.

In a world where data breaches and identity theft are all too common, supporting creation of secure passwords is not just a luxury, but an essential measure to protect the digital lives and assets of users worldwide. The necessity of supporting strong passwords cannot be overstated in an era where cyber threats are rapidly evolving and becoming increasingly sophisticated. By implementing maximum length support, businesses and developers demonstrate their commitment to safeguarding user data, fostering trust, and promoting customer loyalty.

Password Maximum Length Limitations #

Common Password Max Length Limits #

Password max length limits have long been a source of contention, as they frequently place unnecessary constraints on users, knowingly undermining the overall security of their accounts. Many systems have historically imposed an arbitrary maximum length, such as 6, 8, 12, or 16 characters, under the erroneous assumption that shorter passwords are easier to remember and manage.

These restrictions however, only limit users’ ability to form strong, secure passwords, rendering them more vulnerable to brute force attacks and other hacking attempts. It is overdue for developers and businesses to abandon these antiquated methods and embrace the need for lengthier password limits, allowing users to better control their digital security and secure their precious data.

Maximum Password Length: Why do Length Limits Exist? #

Length restrictions occur mostly as a result of historical and technological constraints, as well as erroneous worries about usability. Because storage and processing resources were rather limited in the early days of computers, developers implemented password length constraints to conserve resources and assure optimal system operation. However, as technology and our understanding of cybersecurity have grown, it has become increasingly evident that these length constraints are ineffective and dangerous. In today’s digital landscape, we must reconsider the justification for these length constraints and favor robust security measures above outmoded norms.

The Consequences of Short Password Limits #

Short password constraints can have far-reaching and negative repercussions, as they essentially compromise the security and integrity of users’ digital accounts. Systems unwittingly encourage users to choose weak, readily guessable passwords by enforcing an artificial upper limit, making them attractive targets for cybercriminals. When using short passwords, dictionary attacks, and other common hacking techniques become substantially more effective, increasing the likelihood of unauthorized access, data breach, and identity theft. The consequences of these security flaws can be disastrous for both individuals and businesses, resulting in financial losses, reputational damage, and erosion of user trust. Finally, by adhering to obsolete short password constraints, we are maintaining a cybersecurity culture of complacency and putting our digital lives at risk.

The Benefits of Long Passwords #

Secure Password: Enhanced Security Through Entropy #

Password entropy assesses a password’s randomness and predictability, taking into account the length of the password, its character set, and overall complexity. We build stronger, more secure passwords that are significantly more resistant to hacking attempts by boosting password entropy. High-entropy passwords are less vulnerable to a brute force attack, dictionary attacks, and other typical cybercriminal techniques, creating a formidable barrier to illegal access. As a cornerstone of cybersecurity, we must prioritize the fight for low password predictability.

Resistance to Brute-force Attacks #

Brute-force resistance is an essential aspect of maintaining strong digital security. A classical brute-force attack by cybercriminals attempts to guess a user’s password methodically through trial and error, relying on brute computational power. Credential stuffing and password spraying are two more modern manifestations, that leverage de-hashed credentials from historic data breaches or statistical information on common passwords.

Long, unique passwords are the best security against such assaults since they exponentially increase the number of possible combinations, making it substantially more time-consuming and resource-intensive for attackers to succeed. We develop a powerful line of defense that deters hackers and protects our precious data by embracing password best practices and encouraging users to always use different passwords everywhere.

Encouraging the Use of Password Managers #

Encouraging the use of a password manager is an important step towards boosting digital security and promoting good password usage. A password vault not only securely stores and manages users’ credentials, but also helps to generate long and unique passwords for each account. They relieve users of the burden of creating and remembering high-entropy passwords while dramatically minimizing the risk of illicit access and data breaches.

A good password manager also makes the user experience less stressful, reducing the temptation to reuse weak passwords or utilize insecure storing methods. We must advocate for using a password manager and recognize the importance they play in safeguarding our digital lives, one secure password at a time. Users should avoid using one master password across various services.

Supporting long passwords can present some technical challenges depending on the technologies you already use, particularly when it comes to storage needs and processing times for hashing passwords.

Updating Your Database and Storage #

Adapting to Longer Password Storage #

The first step in supporting long passwords is to allow for a greater number of characters in your credentials database. This can be as simple as updating the password length constraints in your code and database schema.

State-of-the-art hashing algorithms, such as Argon2id, scrypt and bcrypt, generate encoded hash outputs of variable sizes, ranging from 128 to 512 bits or more, depending on the algorithm and setup settings.

The Importance of Secure Hashing #

It is crucial to store passwords in a way that prevents an attacker from obtaining them even if the application or database itself is compromised or breached. To securely store long passwords, use a strong hashing algorithm such as Argon2 or scrypt. These algorithms have been designed to accommodate greater password lengths, but also they are slow and resource-intensive, making offline brute-force attempts more difficult.

According to the Open Worldwide Application Security Project (OWASP), you should make sure to use Argon2id with a minimum configuration of 19 MiB of memory, an iteration count of 2, and 1 degree of parallelism or scrypt with a minimum CPU/ memory cost parameter of (2^17), a minimum block size of 8 (1024 bytes), and a parallelization parameter of 1.

Bcrypt, another extensively used hashing method, has technical constraints that limit passwords to 72 bytes, which is likely insufficient if you wish to allow your users to utilize long unicode passwords.

Transitioning Existing User Data #

Transitioning existing password hashes to a newer, more secure hashing algorithm is an important part of maintaining a strong security posture. As earlier hashing methods become more vulnerable to attacks, it is critical to migrate to modern and resilient algorithms like Argon2. One successful method for achieving this change is to adopt a gradual, seamless process that causes minimal disturbance to users. Using a dual-hash technique, computers can store both the old and new hashes at the same time during the transition period.

When users log in, their passwords are checked against the legacy hash, and if they pass, the new hashing algorithm is applied to same password, and kept alongside the old password hash. As more people log in, the system gradually transitions to the new, more secure hashing mechanism. This technique not only improves security but also indicates a dedication to safeguarding users’ data.

Implementing Front-end Changes #

Adapting User Interface Elements #

To enable increased password max length, designers and developers must prioritize user-friendliness and intuitiveness when accommodating longer passwords within the interface. This involves at least expanding password fields.

If you intend to expand the maximum password length and plan to allow the longest password to have 100 characters, each password field in your sign-up and sign-in experiences should accept at least 101 characters. If a user or their password generator provides a 120-character password, your form can actually notify the user that they have entered too many characters and should input fewer. Otherwise, systems may truncate passwords by accident, which must be avoided!

Enabling Client-side Input Validation #

Client-side password validation is a convenience feature that assists users in creating strong passwords by providing instant feedback (and a security warning in some cases) on the password’s compliance with the password strength policy. Furthermore, this proactive approach reduces server load, as fewer invalid password attempts are sent to the server for processing.

Encouraging Strong Password Practices #

Include a good password strength meter into your login form that gives users real-time feedback as they create their passwords. Especially in combination with a user-friendly password strength policy, visual indicators can be used to encourages users to create long, complicated passwords and educates them on the necessity of strong password security.

Password Manager Support #

Users can use password managers to create and maintain multiple passwords of maximum lengths without having to remember them. By integrating password manager support into your login system, you improve the user experience by enabling seamless autofill capabilities and decreasing the pressure on users to memorize randomly generated credentials.

Back-end Considerations #

Implementing Server-side Password Validation #

Enabling backend-side password input validation is crucial for maintaining a secure and reliable login system since it acts as a last line of defense against incorrect or malicious input. While client-side validation provides rapid feedback and improves user experience, it can also expose systems to security vulnerabilities because it can be bypassed or manipulated by determined attackers. Backend validation guarantees that password inputs comply with defined security policies and requirements, effectively blocking any unauthorized or non-compliant attempts that may have slipped through client-side checks. Businesses and developers establish a multi-layered approach to password security by including both client-side and backend-side validation based on the same rules.

Ensuring Backward Compatibility #

Backward compatibility is critical when adjusting password length limits for businesses and developers looking to improve their login systems without impacting user experience. As systems evolve to support longer, more secure passwords, it is critical to preserve compatibility with old user credentials while avoiding unnecessary friction for users. One useful method is to provide a grace period during which users can continue to use their current passwords while being gently reminded to update them to match the new, stricter requirements. This can be accomplished via in-app notifications, email reminders, or the password reset process.

Long Password Denial of Service #

Password max length constraints can be quite problematic, and there are numerous complaints about overly short password limits all over the internet. Maximum password lengths, on the other hand, are also a wonderful thing to have. Denial of service (DoS) attacks on password hashing for example is a real security risk: By sending a overly long password of e.g. 1.000.000 characters it’s possible to cause severe CPU and memory exhaustion, consequentially resulting in a denial of service attack on the server.

An explicit maximum password length helps furthermore with testing all of your password input fields as well as middleware and with assuring consistency throughout distributed system landscapes. Every strong password strength policy should include an explicit maximum length!

Testing & Monitoring Your Updated System #

After adjusting password length limits, testing and monitoring a login system is an essential component of ensuring a smooth transition and maintaining optimal security standards. As businesses and developers adjust their systems to allow longer, more complicated passwords, it is critical to do extensive testing to evaluate the modified system’s performance, usability, and security. Unit tests, integration tests, and stress tests are all performed to detect potential vulnerabilities, bottlenecks, and opportunities for improvement. Once the system is in place, continual monitoring is required to detect and address any unanticipated issues, track user adoption of the new minimum password length regulations, and assure the security measures’ ongoing efficacy.

Best Practices for Long Password Support #

Adopting a Balanced Password Policy #

A well-balanced password policy encourages users to compose strong, unique passwords by establishing adequate minimum length, complexity, and character diversity criteria that are not unduly restrictive or difficult. This includes criteria such as minimum length and max password length, screening for compromised credentials, and refusing commonly used passwords. Businesses and developers can encourage the use of secure credentials while reducing user frustration and the temptation to use weak, readily guessable passwords by creating an environment in which users can easily adhere to password best practices. Finally, in an increasingly security-conscious digital environment, a balanced password strategy is critical for preserving sensitive information and promoting user confidence.

Regularly Reviewing & Updating Security Measures #

In the constantly evolving field of digital security, where new threats and vulnerabilities arise on a regular basis, assessing and updating security measures is a must. Periodic audits and reviews of existing security measures, such as password policies, hashing algorithms, and encryption techniques, ensure that the login system is up-to-date and resilient to attacks. Businesses can fine-tune their security approach by incorporating input from these evaluations, resolving any flaws and capitalizing on possibilities for improvement.

Staying Informed About New Threats & Trends #

Proactive monitoring of the most recent security trends, research, and best practices enables businesses and developers to stay ahead of potential threats and maintain a strong security posture. While account take-overs through credential stuffing or password spraying are considered a modern security epidemic, also authentication practices are currently transitioning into a new era:

One common trend is to balance security and friction by leveraging passwordless step-up authentication concepts.Another fresh approach are Passkeys that are based on FIDO standards and allow probably the most secure passwordless sign-in experience that ever existed. After Apple started supporting passkeys natively, also Google recently introduced passkeys for Google Accounts and said “So long passwords, thanks for all the phish”.

Make sure to stay informed about offensive threats as well as defensive trends and ensure that you follow industry best practices!

Summary #

Secure password support in your login system is a critical step in securing user accounts and protecting sensitive data. Allowing for larger password lengths, employing a secure hashing algorithm, utilizing password managers, and including password strength validators all help users establish strong, secure passwords. Furthermore, testing and optimization, as well as user education, play an essential role in maintaining a strong login system. To provide a seamless and safe user experience, remember to strike a balance between security and usability.

Frequently Asked Questions (FAQs) #

What is the ideal password length? – The ideal password length is a point of discussion among security experts, however there is universal agreement that longer passwords provide a higher level of protection. To provide proper security, a password should be at least 12-16 characters long. It is crucial to note that as computational power grows, the optimum password length may need to be altered in the future to keep up with evolving threats.
How do I manage long passwords without forgetting them? – Using a password manager is one of the most reliable and handy options. You can also use mnemonic techniques to construct memorable yet strong passwords. For example, you can create a passphrase by mixing the initial letter of each word of a memorable statement with numbers and unique characters. It is critical to avoid using the same password for several accounts!
Are there any drawbacks to using long passwords? – Despite theoretical difficulties in terms of memorability and user-friendliness, the advantages of employing long passwords in terms of improved password security exceed the drawbacks. Backwards compatibility and processing time challenges are no longer viable issues for modern systems.
Is there any security risk in not setting a maximum password length? – An attacker could submit a non-reasonable amount of random characters to the login system if there is no maximum limit, resulting in increased processing time and resource consumption during hashing. Repeated attempts with exceptionally long passwords can result in a DoS attack, which overloads the server and reduces its availability to genuine users.

Max Password Length: A Secure Password Guide

Thu, 04 May 2023 00:00:00 +0200

Today, digital security is more important than ever. With cyber threats on the rise, having strong, unique passwords is critical for protecting your accounts and data. Common sense among security researchers is, that longer passwords are more crucial than complicated ones. In this article, I’ll go into detail about the max password length recommendation, how it affects your digital security, and how to generate the most secure passwords available.

Password Length Recommendations #

A Look into Password Length #

Before we look at password guidelines and how to choose the right length, let’s go over why length is important. Longer passwords are generally more secure since they increase the number of possible combinations that a brute-force attack would have to try. To put it another way, the longer the password, the more time and effort it takes hackers to crack it.

The NIST Guidelines #

The National Institute of Standards and Technology (NIST) released their latest password security standards as part of the digital identity guidelines in 2017. The NIST password guidelines recommend a minimum password length of 8 characters, but no maximum length is specified. Instead, NIST advises users to establish long, complex passwords that are easy to remember but difficult to guess for others. The European Union Agency for Cybersecurity (ENISA), the European NIST-counterpart, mentions in their report on Security Hygiene from 2020 that user generated passwords should at least have 12 characters.

Why No Max Length? #

NIST does not advocate for a maximum password length because they believe it is more essential to focus on the complexity requirements and uniqueness of passwords. A longer password is generally considered more secure than a short one, independent of its characters, numbers, and symbols composition and whether it fulfils arbitrary password complexity requirements.

So, What’s the Ideal Length? #

While NIST does not specify a maximum secret length, most cybersecurity experts agree that a unique password of 12 to 16 characters is sufficient for most common use-cases today. This length strikes a good balance between security and memorability. However, this is not intended to prevent service providers from allowing users to choose longer secrets – rather the opposite! According to OWASP, a common maximum length is 64 characters due to limitations in certain hashing algorithms. Imposing characters on users is actually considered bad practice.

Creating Strong Passwords #

Complex Passwords & the Importance of Unpredictability #

When it comes to creating a secure password, unpredictability is key. Avoid utilizing information that is easily guessed, such as names, dates, or common words and common passwords. Do not reuse passwords, but use a unique combination of lower- and uppercase characters, numerals, and special characters. Avoid sequential characters and use machine generated passwords! Make them longer!

Passphrases: A Password Manager Alternative #

For people without any password managers at hand, it is hard to remember complex passwords. Passphrases are a good alternative to conventional passwords. They are composed of a series of random words, making them easier to remember but more difficult to crack, especially when combined with special characters to protect against dictionary attacks. For example, “Butterfly_machine/skyscraper_twilight” is a unique password that satisfies the password length recommendation. Always keep in mind however, that the only secure password is the one you can’t remember.

Use a Password Manager #

Password managers are useful applications that can assist you in creating and storing complicated, one-of-a-kind passwords for all of your user accounts. They can create passwords that comply with strong password security recommendations and securely store them so you don’t have to remember them. My personal recommendation for password creation and secure storage is 1Password, but there are many useful alternatives out there!

Common Password Pitfalls #

Short Passwords #

User created passwords are often too short. Many online platforms and services still apply password policies that are decades behind modern threat vectors, with outdated minimum password length requirements and composition rules. Often companies shy away from introducing any kind of additional friction in their sign-up or authentication process, enabling malicious actors to be successful with only few password attempts. Always make sure to use a complex password to minimize security risks.

Reusing Passwords #

One of the most common mistakes people practice with their passwords is to reuse passwords across several accounts. If a hacker cracks, guesses or brute-forces one password, they may be able to gain access to multiple accounts if the same password is employed by the user. Ensuring passwords are different for each account is key!

Writing Passwords Down #

Writing down your passwords might seem to poses a significant security risk. If someone finds the written passwords, they can easily gain unauthorized access to your accounts. However, these security risks surely depend on your private threat model. For most common endusers, writing passwords down into a physical password vault is actually a great idea if it leads to more unique and long passwords being used. In any case, consider using a password management tool instead!

Ignoring Two-Factor Authentication #

Multi-factor authentication (2FA) protects your accounts by adding an extra layer of security using passwordless authentication approaches. Even if someone guesses your most commonly used passwords, they’ll need to also get access to your 2FA method (such as a text message or an authentication app) to log in. Enable 2FA whenever it is available!

FAQs #

What is the Max Password Length Recommendation? #

The max length recommendation refers to the best length for maximum security. Neither the NIST guidelines nor security researchers specify a maximum length – for good reason! A longish password is generally considered more secure. Most cybersecurity and password policy experts recommend to use secrets of at least 12 to 16 characters for the best balance of security and memorability. Arbitrarily short limitations of below 64 characters should not be imposed on users!

How does Password Length affect Security & Brute-Force Attacks? #

The number of characters is important for passwords because it increases the number of possible combinations that an attacker must try in brute-force attacks. Every character added also increases time and effort required for password cracking (the recovery of hashed passwords with brute force). An 8-character password will take anywhere from a few minutes to a couple of hours to crack while a 16-character password will take a cracker years, which renders even offline attacks non-sustainable. A long password is also harder to guess.

What is a Passphrase & How is it different from a Password? #

A passphrase is a string of random dictionary words that is used to create a safe password. Passphrases are typically longer and hence are considered more secure than regular, weak passwords, as well as easier to remember. They are a useful approach to create lengthy passwords and offer a higher level of security. Better use a secure password generator!

Why should I avoid Reusing Passwords? #

Reusing passwords across multiple accounts is a dangerous practice because a single data breach can put all your other accounts at risk. If a malicious actor manages to crack one password, they can potentially access multiple accounts with the same password. It’s essential to use unique passwords for each account to protect your digital identity.

What is a password manager, and how can it help me? #

A password manager is an app that allows you to create, save, and manage complex, unique passwords for all of your accounts. It can create passwords that adhere to best practices for password complexity and store passwords securely so you don’t have to remember them.

Conclusion #

Finally, length is a critical attribute of password strength. You may dramatically improve the security of your accounts and data by creating strong passwords that are at least between 12 and 16 characters long, use a combination of character classes, numbers, and special characters, and avoid typical password problems. Don’t forget to think about utilizing passphrases or a secure password generator to make the procedure even easier and more secure.

Additional Tips for Strengthening Your Password Security #

Now that we’ve covered the minimal and maximal password lengths and the necessity of creating secure passwords, let’s look at some extra ideas that help you boost your password security even further.

No Need to Regularly Update Your Passwords – There is no need to change a strong password. There is no need for automatic password expiration. Changing your passwords every three to six months adds no security benefit and will not increase password protection. If you use complex passwords frequent password changes are simply unnecessary.
Be Cautious with Password Recovery Questions – Password recovery questions might be a vulnerability in your account security because they frequently incorporate personal information that hackers can easily find. Don’t use any kind of recovery or security questions. If you have to, complain and if there is no way around it, choose questions with answers that aren’t readily available online or easily guessed.
Monitor Your Accounts for Suspicious Activity – Check your accounts on a regular basis for any signs of unauthorized access or questionable behavior. If you discover anything out of the ordinary, change your password immediately and notify the service provider and proper authorities.
Educate Yourself on Phishing Scams – Cybercriminals use phishing scams to lure you into disclosing sensitive information such as your passwords or personal information. Never click on strange links or download attachments from unfamiliar sources, and be wary of unsolicited emails, messages, or phone calls requesting your password or personal information.
Use a VPN When on Public Wi-Fi – Using public Wi-Fi networks puts your data at risk of being compromised by hackers and other bad actors. When connecting to public Wi-Fi networks, use a Virtual Private Network (VPN) to protect your data and account security. A proper VPN adds an additional layer of encryption and ensures the privacy and security of your online activity.

Do password strength meters work?

Wed, 03 May 2023 00:00:00 +0200

Latest change (2026-10-13): Rewritten as a field-guide entry: question title, short answer, key findings and evidence table. Study summaries kept. Corrected the summary of the meter experiment and the zxcvbn guess count (10^5, not 105).

Short answer: Meters work under the right conditions. In one study they produced stronger passwords when people changed passwords on important accounts, and made no observable difference for an unimportant one. Many deployed meters also label weak passwords as strong, so a useful meter has to estimate how guessable a password really is.

Key findings #

Password meters produced significantly stronger passwords when people had to change their real passwords on important accounts.

Source: Egelman et al., Does My Password Go up to Eleven? (CHI 2013)

Link to this finding Save as image (PNG, 1200 by 630 pixels)

When people created a password for an unimportant account, meters made no observable difference because they reused weak passwords from similar low-risk accounts.

Source: Egelman et al., Does My Password Go up to Eleven? (CHI 2013)

Link to this finding Save as image (PNG, 1200 by 630 pixels)

Password meters at popular web services gave highly inconsistent ratings for the same password and labeled many weak passwords as strong or even very strong.

Source: de Carné de Carnavalet and Mannan, From Very Weak to Very Strong: Analyzing Password-Strength Meters (NDSS 2014)

Link to this finding Save as image (PNG, 1200 by 630 pixels)

A strength estimator with 1.5 MB of compressed data can accurately estimate the best-known guessing attacks up to 10^5 guesses.

Source: Wheeler, zxcvbn: Low-Budget Password Strength Estimation (USENIX Security 2016)

Link to this finding Save as image (PNG, 1200 by 630 pixels)

Researchers recommend combining minimum-strength and minimum-length password requirements for high-value accounts, and found that adding blocklists provides no further gains.

Source: Tan et al., Practical Recommendations for Stronger, More Usable Passwords (CCS 2020)

Link to this finding Save as image (PNG, 1200 by 630 pixels)

Evidence #

Password strength meter studies
Study	Year	Sample	Method	Finding
Does My Password Go up to Eleven? The Impact of Password Meters on Password SelectionUC Berkeley, University of British Columbia, Microsoft Research	2013	47 lab participants; 541 field participants	Laboratory experiment with real password changes, field experiment	Meters helped on important accounts and made no observable difference on an unimportant one.
From Very Weak to Very Strong: Analyzing Password-Strength MetersConcordia University	2014	13 meters from 11 web services; nearly 4 million passwords	Black-box testing with password dictionaries	Meters disagree with each other and rate many weak passwords as strong.
zxcvbn: Low-Budget Password Strength EstimationDropbox	2016	Leaked password sets	Comparison against 4 modern guessing attacks	1.5 MB is enough to estimate guessing attacks accurately up to 10^5 guesses.
Fast, Lean, and Accurate: Modeling Password Guessability Using Neural NetworksCarnegie Mellon University	2016	n/a	Neural network guessing models, client-side JavaScript implementation	Neural networks often guess passwords better than earlier models and compress to hundreds of kilobytes.
Practical Recommendations for Stronger, More Usable PasswordsCarnegie Mellon University	2020	n/a	2 online experiments	Combine minimum-strength and minimum-length requirements; blocklists add no further gains.

What to do #

For engineers #

Estimate strength from guessability, using a model such as zxcvbn or a neural network, and stop counting character classes. Wheeler calls counts of lower- and uppercase letters, digits and symbols “a conclusively burdensome and ineffective security practice”.
For high-value accounts, combine a minimum length with a minimum-strength check. Tan et al. found that character-class requirements may provide very little improvement against expert attackers “and may even reduce effective security”.
Allow long passwords and passphrases so the strength check has something to reward. See password length and long password support.

For product and UX #

Never show “strong” for a weak password. de Carné de Carnavalet and Mannan conclude that meters “should avoid providing misleading strength outcomes, especially for weak passwords”.
Give advice people can act on, not only a coloured bar. Melicher et al. name “giving user-interpretable advice to improve passwords during password creation” as the remaining challenge.
Put effort into meters where they matter: password changes on important accounts. On throwaway sign-ups, a meter won’t stop people from reusing a weak password. My password policy guide covers the rest of the policy.

The studies in detail #

Impact of Password Meters on Password Selection #

Researchers from UC Berkeley, the University of British Columbia and Microsoft Research performed “a laboratory experiment to examine whether [password] meters influenced users’ password selections when they were forced to change their real passwords”. The 47 participants didn’t know that their passwords were the subject of the study, and the meters yielded significantly stronger passwords.

A follow-up field experiment with 541 participants tested a different scenario: creating a password for an unimportant account. There the meters made no observable difference, as participants simply reused weak passwords from similar low-risk accounts. The authors conclude that meters help “when users are forced to change existing passwords on ‘important’ accounts” and that individual meter design decisions likely have a marginal impact.

Read the paper (PDF)

Analyzing Password-Strength Meters #

Researchers from Concordia University tested 13 password meters from 11 popular web services, including Google, Yahoo! and PayPal, with nearly 4 million passwords from password dictionaries. They found highly inconsistent ratings for the same password across meters and many weak passwords labeled as strong or very strong. The study is from 2014, but I still see most of these problems on live sites. The authors argue that meter design deserves real expertise and research, and that, at least, “the current meters should avoid providing misleading strength outcomes, especially for weak passwords.”

Read the paper (PDF)

Low-Budget Password Strength Estimation #

In this reference paper for the zxcvbn strength estimator from Dropbox, Daniel Lowe Wheeler shows that 1.5 MB of compressed storage is enough to accurately estimate the best-known guessing attacks up to 10^5 guesses. With 245 kB and 29 kB, zxcvbn covers 10^4 and 10^3 guesses respectively. The paper compares the estimator against 4 modern guessing attacks and presents it as a better replacement for composition requirements.

Read the paper (PDF)

Modeling Password Guessability Using Neural Networks #

In 2016, researchers from Carnegie Mellon University showed that artificial neural networks can often guess passwords more effectively than probabilistic context-free grammars and Markov models. The networks can be compressed to as little as hundreds of kilobytes without substantially worsening guessing effectiveness. With this result, the authors built the first principled client-side model of password guessing in JavaScript.

“While we measured client-side strength metrics based on guessing effectiveness, a remaining challenge is giving user-interpretable advice to improve passwords during password creation.”

Read the paper (PDF)

Practical Recommendations for Stronger, More Usable Passwords #

In their 2020 study, Carnegie Mellon University researchers ran 2 online experiments and formulated “concrete recommendations for policy configurations that produce a good balance of security and usability”. They give clear guidance on composition requirements, blocklists, and minimum-strength requirements driven by neural-network strength estimates.

“We recommend a 1c12+NN10 minimum-strength policy for organizations that wish to protect high-value accounts without a substantial negative usability impact.”

In plain terms, the recommended policy requires at least 12 characters and a password that passes the neural-network strength check. I consider this paper one of the most comprehensive and influential collections of best practices for password policies.

Read the paper (PDF)

How common is password reuse?

Thu, 27 Apr 2023 00:00:00 +0200

Latest change (2026-10-13): Rewritten as a field-guide entry: question title, short answer, key findings and evidence table. Study summaries kept. Added sample sizes and numbers from the papers’ own text and corrected the affiliations for The Tangled Web of Password Reuse.

Short answer: Password reuse is very common. One study estimates that 43-51% of users reuse the same password across sites, and an in situ study found exact or partial reuse in about 60% of unique passwords. An attacker who holds a user’s password from one site can guess that user’s password elsewhere far more easily.

Key findings #

An estimated 43-51% of users reuse the same password across multiple sites.

Source: Das et al., The Tangled Web of Password Reuse (NDSS 2014)

Link to this finding Save as image (PNG, 1200 by 630 pixels)

With a user’s password from another site, a cross-site guessing algorithm guessed 30% of transformed passwords within 100 attempts, compared with 14% for a standard guessing algorithm.

Source: Das et al., The Tangled Web of Password Reuse (NDSS 2014)

Link to this finding Save as image (PNG, 1200 by 630 pixels)

When researchers observed 154 people’s real logins for an average of 147 days, about 60% of their unique passwords were exactly or partially reused.

Source: Pearman et al., Let's Go in for a Closer Look: Observing Passwords in Their Natural Habitat (CCS 2017)

Link to this finding Save as image (PNG, 1200 by 630 pixels)

People reuse each password on 1.7-3.4 websites, and they mostly reuse the complex passwords they have to enter frequently.

Source: Wash et al., Understanding Password Choices (SOUPS 2016)

Link to this finding Save as image (PNG, 1200 by 630 pixels)

Fewer than a third of people shown a typical password-reuse notification said they intended to change any passwords.

Source: Golla et al., Designing Password-Reuse Notifications (CCS 2018)

Link to this finding Save as image (PNG, 1200 by 630 pixels)

Evidence #

Password reuse studies
Study	Year	Sample	Method	Finding
Let's Go in for a Closer Look: Observing Passwords in Their Natural HabitatCarnegie Mellon University, ICSI, Google	2017	154 participants, 147 days on average	In situ measurement on participants' computers	About 60% of unique passwords were exactly or partially reused.
The Tangled Web of Password ReuseUniversity of Illinois, Princeton, Indiana University	2014	Several hundred thousand leaked passwords from 11 sites; 224 survey responses	Leak analysis, survey, guessing experiment	Estimated 43-51% of users reuse the same password across sites.
Understanding Password Choices: How Frequently Entered Passwords are Re-used Across WebsitesMichigan State University, Macalester College	2016	134 participants over 6 weeks	Survey combined with measured online behaviour	Each password is reused on 1.7-3.4 websites, mostly the frequently entered ones.
A Large-Scale Study of Web Password HabitsMicrosoft Research	2007	Over half a million users, 3 months	Client-side measurement	The average user had 6.5 passwords, each shared across 3.9 sites.
Designing Password-Reuse Notifications	2018	180 and 588 respondents	2 online user studies of notification designs	Fewer than a third of respondents in study 1 intended to change any password.

What to do #

For engineers #

Assume that some of your users’ passwords are already in another site’s breach. Check passwords against breach data at sign-up, password change and login. The compromised credentials entry covers protocols that do this without sending the password to a third party.
Treat a correct password as one signal among several. Das et al. show that a leaked password from another site gives an online attacker a large head start, so rate limits alone aren’t enough. See reinforced authentication and step-up authentication.
Make unique passwords cheap for users: allow paste, long passwords and autofill so a password manager works. I wrote about this in password-manager-friendly login forms and long password support.
Where you can, offer a factor that can’t be reused at all, such as passkeys. See my critical notes on passkeys.

For product and UX #

Composition rules can backfire. Wash et al. found that people memorize a strong password for a site they log into often and then reuse it elsewhere. Read password policy before adding another character-class rule.
Don’t rely on a notification alone. Golla et al. conclude that “notifications alone appear insufficient in solving password reuse”. Pair the message with a forced reset and a clear next step, such as using a password manager.

The studies in detail #

Observing Passwords in Their Natural Habitat #

Researchers from Carnegie Mellon University, the International Computer Science Institute and Google instrumented the computers of 154 participants for an average of 147 days each. They wanted to analyze “password characteristics and behaviors across the full range of participants’ web-based accounts”.

Among other things, the data showed “that the use of symbols and digits in passwords predicts increased likelihood of reuse, while increased password strength predicts decreased likelihood of reuse; that password reuse is more prevalent than previously believed, especially when partial reuse is taken into account”. Of 1,578 unique passwords, 32% were exactly reused and about 60% showed some form of reuse.

Read the paper (PDF)

The Tangled Web of Password Reuse #

This 2014 study by researchers from the University of Illinois, Princeton and Indiana University used several hundred thousand leaked passwords from 11 websites and a user survey with 224 responses. The authors estimate that “43-51% of users reuse the same password across multiple sites”. They also identified “a few simple tricks users often employ to transform a basic password between sites” and built the first cross-site password-guessing algorithm.

That algorithm guessed 30% of transformed passwords within 100 attempts, compared with 14% without knowledge of the other site’s password. A leaked password helps the attacker even when the user changed it slightly for the next site.

Read the paper (PDF)

Understanding Password Choices: How Frequently Entered Passwords are Re-used Across Websites #

Researchers from Michigan State University and Macalester College combined survey answers with the measured online behavior of 134 participants over 6 weeks. They found “that people do tend to re-use each password on 1.7–3.4 different websites” and that “they reuse passwords that are more complex, and mostly they tend to re-use passwords that they have to enter frequently”.

The most interesting observation is how accounts depend on each other, which shows the trouble with arbitrary password composition requirements:

“[…] if users must memorize a strong password on a website where they have to enter it frequently, they then re-use it elsewhere. This results in stronger passwords on more websites. This practice puts users at greater risk of cross-site password guessing attacks […]”

Read the paper (PDF)

A Large-Scale Study of Web Password Habits #

Microsoft researchers measured the password use and reuse of over half a million users over 3 months in 2007, using a client component on users’ machines. It was the first large-scale study of its kind. The average user had 6.5 passwords, each shared across 3.9 different sites, and about 25 accounts that required a password. The authors write that the results “particularly confirm the conventional wisdom about the large number and poor quality of user passwords. In addition passwords are re-used and forgotten a great deal.”

Read the paper (PDF)

Designing Password-Reuse Notifications #

When companies find stolen credentials and notice password reuse, they may require a password reset and notify affected users. Researchers from Germany and the USA ran 2 user studies in 2018 to learn how people react to such notifications. In the first, 180 respondents each saw 1 of 6 notifications that real companies had used, and fewer than a third reported an intention to change any passwords. In the second, 588 respondents saw 1 of 15 variations of a model notification. The authors discuss “best practices for password-reuse notifications and how notifications alone appear insufficient in solving password reuse”.

Read the paper (PDF)

How to Design a Strong & Usable Password Policy

Wed, 26 Apr 2023 00:00:00 +0200

Importance of Password Policy Best Practices #

In today’s digital landscape, both password management and security are more important than ever before. With data breaches and cyberattacks on the rise, it’s crucial that organisations implement strong password policies to protect against credential stuffing, password spaying and related password attacks. However, designing a secure password policy that is both effective and user-friendly can be a challenging task. A password policy that is too complex or difficult to follow introduces friction that will lead to user frustration, while a policy that is too lax can put the organisation and its user accounts at risk.

In this article, I’ll explore the key components of a strong password policy based on state-of-the-art research and provide practical tips for striking a balance between security and usability. Whether you’re a security professional looking to establish a company password policy and guidelines in your organisation, or a web developer who wants to create the ultimate user authentication experience without sacrificing security, this article is for you. So let’s dive in and discover how to design a password policy that’s user-friendly and effective.

Key Components of a Modern Password Policy #

Contrary to common believe and uncountable terribly bad examples of sites leveraging the dumbest password composition policies in the open wild, security researchers are pretty clear on the key components of a password policy. These ingredients are essential to your password hygiene to be both effective in protecting against unauthorized access and usable for your users:

Minimum-strength – First and foremost, your password policy should include minimum-strength requirements. This means that passwords must meet certain criteria in order to be considered strong enough to use.
Minimum-length – The most important characteristic of a strong password is its length. A minimum password length should be long enough to provide a sufficient level of security. Every password policy should enforce strict minimum-length requirements while keeping usability in mind. Longer passwords are more secure passwords.
Blocklist – Lastly, a blocklist requirement should be included to prevent users from using easily guessable, weak passwords such as password123, 12345678 or other common passwords. A blocklist can also be used to prevent users from using passwords that showed up in data breaches, which will help to increase the overall security of your password policy even more.

By combining minimum-strength, minimum-length, and blocklist password requirements together, you can create a password policy that strikes the perfect balance between usability and security. Your users will be able to easily remember their passwords, while also feeling confident that their accounts are secure from unauthorized access. Secure passwords are difficult to guess, and hence much less susceptible to credential stuffing, dictionary attacks or brute force attacks.

A compilation of 292 sites with dumb password rules.

Why Arbitrary Password Policies are Bad #

Arbitrary password complexity and composition policies are a common “feature” of many password policies, and they can actually do more harm than good. These complexity requirements often require users to create passwords that meet certain arbitrary requirements, such as including certain character classes like the number of uppercase letters, lowercase letters, numbers, and special characters. However, research has shown that these policies are no security silver bullet and can actually lead to weaker passwords and increased frustration for users:

“Our experimental results provide the first concrete evidence that character-class requirements should be avoided not only because users tend to find them annoying, but also because they don’t provide substantial bene!t against attackers using state-of-the-art password-cracking tools.”

Stop Password Complexity Requirements! #

To illustrate this point, consider the case of a large e-commerce organisation that implemented an arbitrary password composition policy requiring passwords to include at least one uppercase letter, one lowercase letter, one number, and one special character. After implementing this policy, they found that many users were using passwords like P@ssword1, Qwerty1!, and W3lcome!. These passwords were easy to guess and provided little protection against attacks.

Instead of relying on character classes and strict composition policies, it is better to focus on creating strong passwords that are easy for users to come up with and to remember. This core recommendation is also already standardised in the NIST password guidelines within their digital identity guidelines and can be achieved by using techniques like passphrases. Passphrases typically result in longer phrases that are easy to remember but difficult for attackers to guess. By focusing on usability and secure password creation techniques, you can create a password policy that is both effective and user-friendly.

Sophisticated composition policies should only be leveraged when directly interacting with password managers – I recently wrote about How to make your login and sign-up processes password manager friendly!

Best Practices for Implementing a Password Security Policy #

Now that you understand the key components of a strong and user-friendly password policy, as well as reason for why difficult passwords are not the holy grail, it’s important to consider implementation practises. How can you balance security with usability when implementing a password policy? In this section, I’ll discuss password strength best practices that will help you with implementing a state-of-the-art password policy that is backed by research. By following these guidelines, you can ensure that your users will create strong passwords without frustration due to arbitrary numbers and special characters enforcement.

Minimum Password Length #

What is the optimal password length for maximum security? Well, as usual the answer depends on your threat model. For organisations protecting high-value accounts without a substantial negative usability impact appetite, research suggests that a well-defined password strength policy should include a composition rule of 1c12+NN10. This fancy formula transformed into plain-text English basically translates to “a password including at least one character class (1C) of at least 12 characters length (12) and not guessable by a neural-network based password cracker in under 10 billion tries (NN10)”.

So from an academic perspective, 12 characters long passwords should be good enough for the majority of services if you can ensure that common crackers would need more than 10 billion tries to guess successfully the same password. However, eight characters seems to still be the more widespread minimum length requirement out there.

How to calculate the guessability of a password will be covered in the next section when I’ll describe, how you can implement a low-budget password strength estimation.

Minimum Password Strength #

As you already learned, password policy best practices suggest to grant composition-freedom to the user and to rather focus on estimating how many guesses a neural-network based password cracker would need to find a match. Of course, not everyone of us always has a private neural-network at hand, but there are budget-friendly alternatives. The potentially most popular strength estimator inspired by password crackers is zxcvbn by Dropbox:

“Through pattern matching and conservative estimation, it recognizes and weighs 30k common passwords, common names and surnames according to US census data, popular English words from Wikipedia and US television and movies, and other common patterns like dates, repeats (aaa), sequences (abcd), keyboard patterns (qwertyuiop), and l33t speak.”

Most importantly and among other useful characteristics, zxcvbn spits out rather accurate estimates on “guesses needed to crack the password”. Libraries exist for pretty much every programming language and most of them can be extended with custom dictionaries and keyboard layouts.

Password Blocklists #

While common passwords definitely should be banned, other weak or stolen passwords also deserve your attention. Many regular users reuse default passwords across services, as these 5 alarming password reuse studies show. Credential stuffing attacks using compromised credentials can be considered “epidemic” and are currently one of the largest threats for user passwords and accounts.

My recommendation is to perform server-side leaked password checks against a large set of leaked passwords like the Have I Been Pwned password list. As this list of breached passwords also includes all commonly used secrets and simple passwords, your password blocklist requirement should be fulfilled. Alternatively and likely with a little less friction for your users attached, you can deny compromised credential pairs (email+secret) by checking for example against the No More Leaks data set provided by Dutch authorities. Here you would likely want to incorporate an additional common passwords blocklist, leveraging some fuzzy matching.

Additionally, you definitely want to check for and deny passwords that match the corresponding username.

Conclusion #

Striking a balance between friction and security for account security is possible – even without a sophisticated security awareness training. Moving intellectual workload away from the user and following password security approaches that truly result in measurable defense improvement while offering frictionless experiences to regular users, is the quintessence of the password policy best practices I shared in this article.

As security always depends on your local security risks assessment and threat model while acceptable usability trade-offs pretty much depend on your audience, consider the following quick recap list of “dos and don’ts” as general guidance, not as hard requirements:

10 Dos & Donts For An Effective Password Strength Policy #

Do apply a minimal length requirement of at least 12 characters.
Do apply a minimal strength requirement based on guessability indicators.
Do apply active blocklisting either based on breached data or using fuzzy matching common passwords.
Do prevent users from using credentials pairs were username equals secret.
Do allow unicode characters. Character set, character types and classes should be up to the users.
Do consider disallowing the use of known to be compromised credential pairs.
Do become password manager friendly. Encouraging users to leverage secret generators is very valuable.
Do provide multi factor authentication means.
Don’t enforce a maximum length requirement, there is better ways to handle DoS.
Don’t apply composition rules and avoid enforcing specific character classes.
Don’t check for minimum password age or enforce users to regularly change passwords.

As usual, feel free to drop me message on Mastodon if you have any suggestions, feedback or comments!

Frequently Asked Questions (FAQ) #

Do password meters discourage users from using complex passwords? #

Password meters are visual strength indicators that can help users create strong passwords by providing feedback on the strength of their previous password choices. However, some users may feel discouraged by these meters, especially if they perceive them as too strict or limiting. In some cases, this can lead to users choosing simpler and less secure passwords in order to avoid the frustration of dealing with a password meter.

Research suggests, that these meters only make a difference “when users are forced to change existing passwords”. Pure visual indicators seem to have no significant effect.

Should password meters take into account the likelihood of a password being guessed by an attacker? #

Yes, your password strength policy should definitely take into consideration how easy it is for malicious actors to guess passwords. How guessable a password is can get directly linked to it overall strength. The actual character composition should not be restricted.

Should I use a blacklist of commonly used passwords to prevent users from using weak passwords? #

Yes, using a blacklist is a good practice to prevent users from using commonly used, formerly breached and reused passwords and hence easy to guess passwords. It is important to note that relying solely on a blacklist is not enough to create a strong password policy. Other best practices such as setting a password length requirement, and implementing multi-factor authentication should also be considered. By using a combination of these measures, you can ensure that your users are creating strong and secure passwords.

Should I use a password manager to create and store strong passwords? #

Yes, and you should educate your users about the benefits of password management tooling. Creating passwords using a password management tool is a highly recommended practice to ensure better security of your online accounts. A password management system can generate long, complex, and unique passwords for each account, reducing the risk of guessing or cracking. Additionally, they can securely store your passwords and automatically fill them in when you visit a website or app, making it easier for you to use a unique and complex password without the need to remember them.

Is it safe to use the same password for multiple accounts? #

In short, no, it is not safe to reuse passwords (and especially credential pairs) across various services. Doing so can lead to disastrous consequences, as it drastically increases your personal account security risk. A security breach on one service can compromise all of your accounts with same passwords. For example, if you use the same password for your email, social media, and e-commerce accounts, a successful data exfiltration on a social media platform will allow malicious actors to also gain access to your other accounts.

How to: Password-Manager Friendly Login Forms

Sun, 23 Apr 2023 00:00:00 +0200

Do you ever get tired of manually typing in your login credentials every time you need to access an online account? Luckily, there is a solution: password managers. These handy tools can automatically generate and store strong passwords, but they’re only truly useful if login forms are password-manager friendly. In this article, I explore how you can make your login forms more compatible with password managers to improve the user experience and enhance security. So, let’s dive in and unlock the key to effortless login!

What is a password manager? #

A password manager (PWM) is powerful a software application designed to help users store and manage their login credentials and other sensitive information securely. It typically works by generating strong, unique passwords for each of the user’s online accounts and storing them in an encrypted database. The user only needs to remember a single master password or use other authentication methods such as biometrics to access the PWM, and it can automatically fill in the login details for the user when they visit your website or application. This can help users avoid the pitfalls of weak, reused, or easily guessed passwords, and enhance the overall security of their digital identities.

If you want my recommendation for one of the best password managers, I’ve always used 1Password.

The internet seems to be full of sites that do things that are very unfriendly to users of a PWM. Common mistakes include disabling copy-pasting (or autofill) features or enforcing dumb password composition policies.

Just imagine you’re in a hurry to purchase that limited pair of sneakers online and need to create an account to complete the transaction. You type in your email address and password, only to realize that the site’s password requirements are arbitrarily strict and your usual password composition strategy doesn’t meet them. Frustrated, you spend precious minutes creating a new password that you know you’ll probably forget later.

With modern password manager support, your login form could have easily supported a users PWM with generating a strong, unique, suitable password in seconds and saved it for future use. As identity providers and login form maintainers we must make using a password manager on our sites as easy as possible!

Form element improvements – To improve the ease of use of password managers on your site make sure that you help browsers and tooling to autofill the password for the correct input field. Although some browsers can find the correct input heuristically even if the login form is not optimized for this purpose, web developers should correctly annotate HTML input elements using the autocomplete attribute.

For example, the account creation form should indicate that it’s expecting a new password and that the password generator should create a new password for this input:

<input type="password" autocomplete="new-password" id="new-password" …>

In context of user authentication, the login form should explicitly indicate that it’s expecting the email address and the current password for the user:

<input type="email" autocomplete="email" id="email" …>
<input type="password" autocomplete="current-password" id="current-password" …>

Strong password policies – Balancing effortless login with improved password security means that arbitrary password composition policies are rightfully considered counter-productive and even harmful nowadays. Researchers and security experts suggest that the single most important characteristic of a password is its length.

Password length requirements can directly be added to the password input element using the pattern attribute:

<input type="password" pattern=".{12,70}" autocomplete="new-password" id="new-password" …>

This length requirement pattern will tell password managers to generate and autofill a new random password of at least 12 characters. While for many manually typing users without an automated password generator this is still achievable, it means to somewhat mis out on the great capabilities of password managers.

Luckily there is a way to have your login form tell 1Password, or other tools generating passwords for you, to apply a way more elaborate password policy using the passwordrules attribute on the input:

<input type="password" passwordrules="minlength: 52; maxlength: 70; required: lower; required: upper; required: digit; required: [-];" …>

Password managers like 1Password, will now auto-generate a complex password of at least 52 character length and including a good mixture of character classes.

Although the passwordrules attribute is still a proposal, 1Password recommends to provide these password requirements.

A Well-Known URL for Changing Passwords

Password managers can warn users about breached credentials, but the lack of account security industry standards results in a lot of friction when asking users to change password. The change password URL standard by W3C solves that problem by defining a well-known URL that sites and service provider can use to make their change password forms discoverable by automated tools: /.well-known/change-password

If you use the 1Password browser extension like I am, that leads to a really nice experience. Your users will be happy!

Applying modern password security best practices on your sites and making your account creation and authentication forms more password manager friendly is possible and will result in effortless login experiences for your users. Automated login and form-filling features will have huge time-saving benefits for users with password managers.

Actively supporting PWMs in authentication processes will resolve your users from friction by leveraging more automation. Users will gladly benefit from simplified password management across multiple accounts and platforms.

Becoming password-manager friendly will directly result in more super strong passwords being used by your customers. Moving the responsibility of generating strong, complex passwords from the users to their password managers enables identity providers and account security experts to truly leverage the advantages of complex password composition policies and length requirements.

Helping password managers to better help your users means increasing protection against common threats not only for your users but also for your service or site. Improved overall security is a direct consequence.

Conclusion #

While we wait for the emerging technologies and techniques like passwordless authentication and FIDO Passkeys to become commodities and eventually resolve us from simple password schemes, we can and should make passwords easier to use. Getting rid of outdated and frustration-prone password policies while investing on making login forms more password manager friendly is a must for identity providers and web developers maintaining authentication experiences.

With modern form element improvements like autocomplete, pattern and passwordrules attributes, your sign-in process will become best friends with many password managers out in the wild!

Feel free to drop me message on Mastodon if you have any suggestions or comments!

How do you protect accounts from stolen credentials?

Fri, 21 Apr 2023 00:00:00 +0200

Latest change (2026-10-13): Rewritten as a field-guide entry: question title, short answer, key findings and evidence table. Study summaries kept. Replaced the broken link to the password breach alerting paper with the USENIX copy.

Short answer: Check usernames and passwords against breach data with a privacy-preserving protocol, and add risk signals such as known devices and locations to the login decision. Breached credentials show up in about 1.5% of logins on the web, and in one study 7-25% of exposed passwords matched the victim’s Google account.

Key findings #

Telemetry from nearly 670,000 users and 21 million logins showed that 1.5% of logins on the web involve breached credentials.

Source: Thomas et al., Protecting accounts from credential stuffing with password breach alerting (USENIX Security 2019)

Link to this finding Save as image (PNG, 1200 by 630 pixels)

26% of breach warnings shown at login led users to switch to a new password at least as strong as the original.

Source: Thomas et al., Protecting accounts from credential stuffing with password breach alerting (USENIX Security 2019)

Link to this finding Save as image (PNG, 1200 by 630 pixels)

Between 7% and 25% of passwords exposed through breaches, phishing kits and keyloggers matched the victim’s Google account.

Source: Thomas et al., Data Breaches, Phishing, or Malware? (CCS 2017)

Link to this finding Save as image (PNG, 1200 by 630 pixels)

In some contexts, the hash prefixes that common breach-checking services receive make remote guessing attacks 12 times more effective.

Source: Li et al., Protocols for Checking Compromised Credentials (CCS 2019)

Link to this finding Save as image (PNG, 1200 by 630 pixels)

Evidence #

Compromised credential studies
Study	Year	Sample	Method	Finding
Protocols for Checking Compromised CredentialsCornell Tech, Cloudflare	2019	Existing C3 services (HaveIBeenPwned, Google Password Checkup)	Formal analysis, leakage simulation, protocol design	Hash-prefix leakage can make guessing 12 times more effective; 2 stronger protocols remain practical.
Protecting accounts from credential stuffing with password breach alertingGoogle, Stanford	2019	Over 4 billion breached credentials; nearly 670,000 users and 21 million logins	Protocol design, Chrome extension telemetry	1.5% of logins involve breached credentials; 26% of warnings led to a new password.
Data Breaches, Phishing, or Malware? Understanding the Risks of Stolen CredentialsGoogle, UC Berkeley, ICSI	2017	1.9 billion breached credentials, 12.4 million phishing and 788,000 keylogger victims	Longitudinal measurement, March 2016 to March 2017	7-25% of exposed passwords matched the victim’s Google account.

What to do #

For engineers #

Check credentials against breach data at sign-up, password change and login. Use a protocol that never sends the password or its full hash to the checking service. Thomas et al. combine “computationally expensive hashing, k-anonymity, and private set intersection”; Li et al. show how much a plain hash prefix can leak.
Don’t decide a login on the password alone. Thomas et al. (2017) show that risk signals such as a user’s historical geolocations and device profiles reduce the hijacking risk from stolen passwords. The reinforced authentication entry collects studies on login risk scoring.
Watch for stuffing and spraying patterns across accounts, not only per account. See password spraying and honeytokens for detection ideas.

For product and UX #

Tell users when their credentials appear in a breach, and make the next step a single action. In the Google study, 26% of warnings led to a new password that was at least as strong.
Expect most users not to act on a warning alone. The password reuse entry covers what makes a notification work and where notifications fall short.

The studies in detail #

Protocols for Checking Compromised Credentials #

“To prevent credential stuffing attacks, industry best practice now proactively checks if user credentials are present in known data breaches.”

For this paper, researchers from Cornell Tech and Cloudflare analyzed existing compromised credential checking (C3) services such as HaveIBeenPwned and Google Password Checkup. They give the first formal description of C3 services, including operational requirements and threat models. Current services have the client share a short prefix of a password hash. The authors show that in some contexts this prefix makes remote guessing 12 times more effective. They then propose “two new protocols that provide stronger protection for users’ passwords”, implement them, and show that they remain practical to deploy.

Read the paper (PDF)

Protecting accounts from credential stuffing with password breach alerting #

Researchers from Google and Stanford describe how Google’s password breach alerting works, which constraints and hard requirements it meets, and which cryptographic protocols it uses. Their cloud service covered over 4 billion breached credentials, and a Chrome extension served as the first client.

“Our protocol relies on a combination of computationally expensive hashing, k-anonymity, and private set intersection. Our approach improves on existing protocols by taking into account both an adversarial client and server, while also minimizing the chance of false positives.”

Anonymous telemetry from nearly 670,000 users and 21 million logins showed that 1.5% of logins on the web involved breached credentials. 26% of the warnings led users to migrate to a new password at least as strong as the original.

Read the paper (PDF)

Data Breaches, Phishing, or Malware? Understanding the Risks of Stolen Credentials #

Between March 2016 and March 2017, researchers from Google, UC Berkeley and the International Computer Science Institute identified 788,000 potential keylogger victims, 12.4 million potential phishing kit victims and 1.9 billion usernames and passwords exposed in data breaches. With this data, they “explore to what degree the stolen passwords […] enable an attacker to obtain a victim’s valid email credentials — and thus complete control of their online identity due to transitive trust”. In their case study of Google accounts, 7-25% of exposed passwords matched the victim’s Google account.

The study is from 2017, but its mitigation still applies today: the authors show that adding risk signals, such as a user’s historical geolocations and device profiles, to authentication helps mitigate hijacking with a correct but stolen password.

Read the paper (PDF)

Passwords · Brennenstuhl on Security

What should a password policy require?

Key findings #

Evidence #

What to do #

For engineers #

For product and UX #

Check your policy #

Compare a policy with SP 800-63B-4

Related #

Password Attack Guide: What is Password Spraying?

Introduction to Password Attacks #

What is Password Spraying? #

The motivation behind password spraying attacks #

How Password Spraying Works #

Targeting Multiple Accounts #

Common Passwords & Dictionary Attack #

The Use of Bots & Automation in Password Spraying #

Password Spraying vs Brute-Force Attack #

Password Spraying vs Credential Stuffing #

Password Spraying vs Dictionary Attack #

Real-World Examples of Password Spraying #

How a Password Spraying Attack Affects Your Customers #

Detecting password spraying attacks #

Sudden Spike in Failed Login Attempts #

Unusual Account Activity #

Password spraying prevention #

IP-Blocking & Geo-Blocking #

Bot Management #

Intermediary Challenges #

Strong Password Policies and Best Practices #

Passwordless Authentication #

Enable Multi-factor Authentication (MFA) #

The Ongoing Battle Against Password Attacks #

Frequently Asked Questions (FAQs) #

Can password spraying be easily detected? #

How can I protect my personal accounts from password-spraying attacks? #

Are there any tools available to help detect and prevent password spraying? #

What should I do if I suspect password spraying compromised my account? #

Is it Possible to Prevent a Password Spraying Attack? #

Passwordless: Critical Notes on FIDO2 Passkeys

Introduction to FIDO2 & Passkeys #

Phishing-resistant Passwordless Authentication #

Public-Key Cryptography #

Biometrics #

Passkeys Controversies #

Possession & Biometrics over Knowledge #

Device Lock-in #

Vendor Lock-in #

Proprietary-only #

100% Trust in Big Tech #

Conclusion #

FAQs #

What is FIDO2? #

How do FIDO2 Passkeys work? #

What are the benefits of FIDO2 Passkeys? #

What are the potential drawbacks of FIDO2 Passkeys? #

Can I use FIDO2 Passkeys on multiple devices? #

Long Password Support for Safer Login Systems

The Importance of Password Security #

The Rise of Long Passwords #

Password Maximum Length Limitations #

Common Password Max Length Limits #

Maximum Password Length: Why do Length Limits Exist? #

The Consequences of Short Password Limits #

The Benefits of Long Passwords #

Secure Password: Enhanced Security Through Entropy #

Resistance to Brute-force Attacks #

Encouraging the Use of Password Managers #

How to Support Long Passwords in Your Login System #

Updating Your Database and Storage #

Adapting to Longer Password Storage #

The Importance of Secure Hashing #

Transitioning Existing User Data #

Implementing Front-end Changes #

Adapting User Interface Elements #

Enabling Client-side Input Validation #

Encouraging Strong Password Practices #

Password Manager Support #

Back-end Considerations #