# Guy who came up with all those crazy password rules now says he's sorry **URL:** \ **Category:** Miscellaneous and Personal Stuff I Must Share\ **Created:** [August 9, 2017, 1:01pm UTC](https://boards.straightdope.com/t/guy-who-came-up-with-all-those-crazy-password-rules-now-says-hes-sorry/793171 "2017-08-09T13:01:55Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![cochrane](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/cochrane/32/10441_2.png) [@cochrane](https://boards.straightdope.com/u/cochrane)\ **Post date:** [August 9, 2017, 1:01pm UTC](https://boards.straightdope.com/t/guy-who-came-up-with-all-those-crazy-password-rules-now-says-hes-sorry/793171/1 "2017-08-09T13:01:55Z")
You know all those special rules for passwords that drive us all crazy, such as one lower case letter, one capital letter, one number, one special character, etc? Well the guy who came up with them has apologized for wasting everybody’s time. > [@](#): > > The only problem is that Bill Burr didn’t really know much about how passwords worked back in 2003, when he wrote the manual. He certainly wasn’t a security expert. And now the retired 72-year-old bureaucrat wants to apologize. > > “Much of what I did I now regret,” Bill Burr told The Wall Street Journal recently, admitting that his research into passwords mostly came from a white paper written in the 1980s, well before the web was even invented. > **[The Guy Who Invented Those Annoying Password Rules Now Regrets Wasting Your Time](https://gizmodo.com/the-guy-who-invented-those-annoying-password-rules-now-1797643987)** > > We’ve all been forced to do it: create a password with at least so many characters, so many numbers, so many special characters, and maybe an uppercase letter. Guess what? The guy who invented these standards nearly 15 years ago now admits that... So, who wants to be first to forgive him? ---
**Author:** ![Broomstick](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/broomstick/32/246_2.png) [@Broomstick](https://boards.straightdope.com/u/Broomstick)\ **Post date:** [August 9, 2017, 1:05pm UTC](https://boards.straightdope.com/t/guy-who-came-up-with-all-those-crazy-password-rules-now-says-hes-sorry/793171/2 "2017-08-09T13:05:42Z")
n0W h3 t3llz Us! Can we now go to the newer, more sensible rules? ---
**Author:** ![cochrane](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/cochrane/32/10441_2.png) [@cochrane](https://boards.straightdope.com/u/cochrane)\ **Post date:** [August 9, 2017, 1:18pm UTC](https://boards.straightdope.com/t/guy-who-came-up-with-all-those-crazy-password-rules-now-says-hes-sorry/793171/3 "2017-08-09T13:18:17Z")
[correct horse battery staple](https://xkcd.com/936/) ---
**Author:** ![Darren\_Garrison](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/darren_garrison/32/92_2.png) [@Darren\_Garrison](https://boards.straightdope.com/u/Darren_Garrison)\ **Post date:** [August 9, 2017, 1:25pm UTC](https://boards.straightdope.com/t/guy-who-came-up-with-all-those-crazy-password-rules-now-says-hes-sorry/793171/4 "2017-08-09T13:25:24Z")
So I can go back to using 12345? ---
**Author:** ![DesertDog](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/desertdog/32/11503_2.png) [@DesertDog](https://boards.straightdope.com/u/DesertDog)\ **Post date:** [August 9, 2017, 2:09pm UTC](https://boards.straightdope.com/t/guy-who-came-up-with-all-those-crazy-password-rules-now-says-hes-sorry/793171/5 "2017-08-09T14:09:25Z")
> [@cochrane](#): > > [correct horse battery staple](https://xkcd.com/936/) After twenty years I still remember the pass code I had to use to get into the AOL account I’d just created right after installing it from the floppy they’d sent me. “dust dregs” and I used it only the one time. ---
**Author:** ![JcWoman](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/jcwoman/32/2889_2.png) [@JcWoman](https://boards.straightdope.com/u/JcWoman)\ **Post date:** [August 9, 2017, 2:15pm UTC](https://boards.straightdope.com/t/guy-who-came-up-with-all-those-crazy-password-rules-now-says-hes-sorry/793171/6 "2017-08-09T14:15:47Z")
I hate those ubiquitous password rules. I used to use alien words or phrases (literally alien, like from sci fi stories), spelled backward. Try cracking THAT with a dictionary! But all the stupid enforced rules everywhere caused me to switch over to lame stuff like Myd0ggy$, and the lifetime rules of all the passwords I have to use at work caused me to switch to stuff like Myd0ggy123 (increment every reset). (Those are obviously not the literally passwords I used.) I would love to go back to my old scheme, or even random phrases. ---
**Author:** ![John\_Mace](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/john_mace/32/185_2.png) [@John\_Mace](https://boards.straightdope.com/u/John_Mace)\ **Post date:** [August 9, 2017, 2:19pm UTC](https://boards.straightdope.com/t/guy-who-came-up-with-all-those-crazy-password-rules-now-says-hes-sorry/793171/7 "2017-08-09T14:19:25Z")
I dunno. Pass1Word2! works great for me and is easy to remember. ---
**Author:** ![ZipperJJ](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zipperjj/32/211_2.png) [@ZipperJJ](https://boards.straightdope.com/u/ZipperJJ)\ **Post date:** [August 9, 2017, 2:24pm UTC](https://boards.straightdope.com/t/guy-who-came-up-with-all-those-crazy-password-rules-now-says-hes-sorry/793171/8 "2017-08-09T14:24:05Z")
He is a bad man and he \*should \*be sorry. ---
**Author:** ![Mangetout](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mangetout/32/19_2.png) [@Mangetout](https://boards.straightdope.com/u/Mangetout)\ **Post date:** [August 9, 2017, 2:40pm UTC](https://boards.straightdope.com/t/guy-who-came-up-with-all-those-crazy-password-rules-now-says-hes-sorry/793171/9 "2017-08-09T14:40:36Z")
> [@John\_Mace](#): > > I dunno. Pass1Word2! works great for me and is easy to remember. Even if you don’t remember, you can just look it up on the list. ---
**Author:** ![Khendrask](https://avatars.discourse-cdn.com/v4/letter/k/3e96dc/32.png) [@Khendrask](https://boards.straightdope.com/u/Khendrask)\ **Post date:** [August 9, 2017, 2:44pm UTC](https://boards.straightdope.com/t/guy-who-came-up-with-all-those-crazy-password-rules-now-says-hes-sorry/793171/10 "2017-08-09T14:44:22Z")
Not only do the password rules suck, but I have incredible hate for the “Security Questions”, unless they at least let you make up your own. I have too many with things like “Your High School”, or “Your Pet’s Name”. Okay, stupid to complain about, but for school, did I put the initials? “AB Charlie HS”? Did I spell it out? “Alpha Bravo Charlie” ? Did I just use the “Charlie”? For pets, My current pet? The pet I had when I made the account? When was that? I generally ignore all of them now, and just have the bank or whatever text me a security code, but a lot still won’t do that. ---
**Author:** ![Spiderman](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/spiderman/32/230_2.png) [@Spiderman](https://boards.straightdope.com/u/Spiderman)\ **Post date:** [August 9, 2017, 3:14pm UTC](https://boards.straightdope.com/t/guy-who-came-up-with-all-those-crazy-password-rules-now-says-hes-sorry/793171/11 "2017-08-09T15:14:43Z")
> [@Khendrask](#): > > Not only do the password rules suck, but I have incredible hate for the “Security Questions”, unless they at least let you make up your own. > > I have too many with things like “Your High School”, or “Your Pet’s Name”. Okay, stupid to complain about, but for school, did I put the initials? “AB Charlie HS”? Did I spell it out? “Alpha Bravo Charlie” ? Did I just use the “Charlie”? > > For pets, My current pet? The pet I had when I made the account? When was that? The ones I hate are the historical ones - name of your first girl/boyfriend? Ummm, I’m old enough to **not** remember. Or your favorite restaurant. It was \_\_\_, but they closed 6 years ago, & I really liked \_\_\_\_, but that was before I moved, etc. :smack: I have too many real accounts, but if I were advising an 18 yo, I’d tell them to make the answer to any question, “Fuck you” or, “I can’t tell you that”. Makes for some fun times when you need to tell it to the CSR on the phone, kind of like Abbott & Costello’s Who’s on First. 😃 ---
**Author:** ![burpo\_the\_wonder\_mutt](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/burpo_the_wonder_mutt/32/365_2.png) [@burpo\_the\_wonder\_mutt](https://boards.straightdope.com/u/burpo_the_wonder_mutt)\ **Post date:** [August 9, 2017, 3:19pm UTC](https://boards.straightdope.com/t/guy-who-came-up-with-all-those-crazy-password-rules-now-says-hes-sorry/793171/12 "2017-08-09T15:19:20Z")
I’m still going to keep using “Guest.” ---
**Author:** ![control-z](https://avatars.discourse-cdn.com/v4/letter/c/eada6e/32.png) [@control-z](https://boards.straightdope.com/u/control-z)\ **Post date:** [August 9, 2017, 3:48pm UTC](https://boards.straightdope.com/t/guy-who-came-up-with-all-those-crazy-password-rules-now-says-hes-sorry/793171/13 "2017-08-09T15:48:11Z")
The Social Security Administration sent me an email telling me I should log in to see my status. Fair enough, typed [ssa.gov](http://ssa.gov) myself into the browser window, logged in using the auto-filled password from my browser, only to be told it had been X months so I had to change my password. Hmm, never mind, it’s not worth the trouble, it is what it is. ---
**Author:** ![Jackmannii](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/jackmannii/32/311_2.png) [@Jackmannii](https://boards.straightdope.com/u/Jackmannii)\ **Post date:** [August 9, 2017, 3:49pm UTC](https://boards.straightdope.com/t/guy-who-came-up-with-all-those-crazy-password-rules-now-says-hes-sorry/793171/14 "2017-08-09T15:49:45Z")
The username/password combo of admin/password hasn’t failed me yet. I would like to find out who’s responsible for claiming that submitted passwords have already been assigned to other users when that clearly isn’t true. I have a hard time believing that GooGleIsExCrEmENtonToAst666 is someone else’s gmail password. :mad: ---
**Author:** ![Sir\_T-Cups](https://avatars.discourse-cdn.com/v4/letter/s/ed655f/32.png) [@Sir\_T-Cups](https://boards.straightdope.com/u/Sir_T-Cups)\ **Post date:** [August 9, 2017, 3:52pm UTC](https://boards.straightdope.com/t/guy-who-came-up-with-all-those-crazy-password-rules-now-says-hes-sorry/793171/15 "2017-08-09T15:52:17Z")
Anyone else see the name of the guy and immediately think of the comedian? ---
**Author:** ![Mollie\_Magill](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mollie_magill/32/20882_2.png) [@Mollie\_Magill](https://boards.straightdope.com/u/Mollie_Magill)\ **Post date:** [August 9, 2017, 4:21pm UTC](https://boards.straightdope.com/t/guy-who-came-up-with-all-those-crazy-password-rules-now-says-hes-sorry/793171/16 "2017-08-09T16:21:35Z")
> [@Darren\_Garrison](#): > > So I can go back to using 12345? I have the same on my luggage! ---
**Author:** ![xizor](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/xizor/32/102_2.png) [@xizor](https://boards.straightdope.com/u/xizor)\ **Post date:** [August 9, 2017, 4:31pm UTC](https://boards.straightdope.com/t/guy-who-came-up-with-all-those-crazy-password-rules-now-says-hes-sorry/793171/17 "2017-08-09T16:31:08Z")
I was entering my password which was chosen by drawing a shape on the keyboard. My co-worker watched me do it and said “Ha! I do that too” ---
**Author:** ![CurtC](https://avatars.discourse-cdn.com/v4/letter/c/ce73a5/32.png) [@CurtC](https://boards.straightdope.com/u/CurtC)\ **Post date:** [August 9, 2017, 4:41pm UTC](https://boards.straightdope.com/t/guy-who-came-up-with-all-those-crazy-password-rules-now-says-hes-sorry/793171/18 "2017-08-09T16:41:35Z")
At my work, we use a third-party site to log our time off, look at payslips, etc. I typically need to access the site about once a month or so. The trouble is, they make you change your password if it’s been more than 30 days. So just about every time I use the site, it makes me change my password. And it’s one that requires not just upper/lower case letters and numbers, but also one of a specific set of symbols - not the same set of symbols my password generator has by default, so it’s sometime extra-difficult. Pisses me off! ---
**Author:** ![Procrustus](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/procrustus/32/2994_2.png) [@Procrustus](https://boards.straightdope.com/u/Procrustus)\ **Post date:** [August 9, 2017, 4:44pm UTC](https://boards.straightdope.com/t/guy-who-came-up-with-all-those-crazy-password-rules-now-says-hes-sorry/793171/19 "2017-08-09T16:44:11Z")
> [@Spiderman](#): > > The ones I hate are the historical ones - name of your first girl/boyfriend? Ummm, I’m old enough to **not** remember. Or your favorite restaurant. It was \_\_\_, but they closed 6 years ago, & I really liked \_\_\_\_, but that was before I moved, etc. :smack: > > I have too many real accounts, but if I were advising an 18 yo, I’d tell them to make the answer to any question, “Fuck you” or, “I can’t tell you that”. Makes for some fun times when you need to tell it to the CSR on the phone, kind of like Abbott & Costello’s Who’s on First. 😃 I like “What color is an orange?” Easy to remember. ---
**Author:** ![CairoCarol](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/cairocarol/32/3825_2.png) [@CairoCarol](https://boards.straightdope.com/u/CairoCarol)\ **Post date:** [August 9, 2017, 4:57pm UTC](https://boards.straightdope.com/t/guy-who-came-up-with-all-those-crazy-password-rules-now-says-hes-sorry/793171/20 "2017-08-09T16:57:10Z")
> [@Mangetout](#): > > Even if you don’t remember, you can just look it up on the list. Tape it to the side of your monitor. [Next page](https://boards.straightdope.com/t/guy-who-came-up-with-all-those-crazy-password-rules-now-says-hes-sorry/793171.md?page=2)