“The man who wrote the book on password management has a confession to make: He blew it,” Robert McMillan reports for The Wall Street Journal.
“Back in 2003, as a midlevel manager at the National Institute of Standards and Technology, Bill Burr was the author of ‘NIST Special Publication 800-63. Appendix A.’ The 8-page primer advised people to protect their accounts by inventing awkward new words rife with obscure characters, capital letters and numbers—and to change them regularly,” McMillan reports. “The document became a sort of Hammurabi Code of passwords, the go-to guide for federal agencies, universities and large companies looking for a set of password-setting rules to follow.”
“The problem is the advice ended up largely incorrect, Mr. Burr says. Change your password every 90 days? Most people make minor changes that are easy to guess, he laments. Changing Pa55word!1 to Pa55word!2 doesn’t keep the hackers at bay,” McMillan reports. “Also off the mark: demanding a letter, number, uppercase letter and special character such as an exclamation point or question mark—a finger-twisting requirement. ‘Much of what I did I now regret,’ said Mr. Burr, 72 years old, who is now retired.”
McMillan reports, “In June, Special Publication 800-63 got a thorough rewrite, jettisoning the worst of these password commandments.”
Read more in the full article here.
MacDailyNews Note: The National Institute of Standards and Technology revised Special Publication 800-63 can be found here.
Always use unique passwords and use Apple’s Keychain Access and iCloud Keychain to create and manage them. For those of us who are smartly all-Apple, it works like a dream.