# Lengthy/complex password policies : waste of time? **URL:** \ **Category:** Factual Questions\ **Created:** [October 9, 2015, 9:23am UTC](https://boards.straightdope.com/t/lengthy-complex-password-policies-waste-of-time/734011 "2015-10-09T09:23:10Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![Slash1972](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/slash1972/32/6461_2.png) [@Slash1972](https://boards.straightdope.com/u/Slash1972)\ **Post date:** [October 9, 2015, 6:08pm UTC](https://boards.straightdope.com/t/lengthy-complex-password-policies-waste-of-time/734011/21 "2015-10-09T18:08:29Z")
> [@madsircool](#): > > Oddly. I have none of these. Passwords that have to be written down arent secure at all. Well, I don’t write them down, just annoying to have to come up with a new one every 90 days. ---
**Author:** ![gazpacho](https://avatars.discourse-cdn.com/v4/letter/g/6f9a4e/32.png) [@gazpacho](https://boards.straightdope.com/u/gazpacho)\ **Post date:** [October 9, 2015, 6:25pm UTC](https://boards.straightdope.com/t/lengthy-complex-password-policies-waste-of-time/734011/22 "2015-10-09T18:25:32Z")
> [@madsircool](#): > > An easy and easy to remember long password would be capital A plus a childhood phonenumber and area code you remember. Make it just about impossible to crack by using three old phone numbers. My childhood phone numbers are all easily available on the internet linked to my name. That seems like a particularly bad way to choose a password. > [@](#): > > Passwords that have to be written down arent secure at all. This is also basically untrue. The people I am trying to keep my password from are random criminal elements somewhere in the world with internet access. Basically 0 of them have access to my office or wallet. So a complicated password written down is much more secure than a simple password not written down. ---
**Author:** ![madsircool](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/madsircool/32/3432_2.png) [@madsircool](https://boards.straightdope.com/u/madsircool)\ **Post date:** [October 9, 2015, 6:45pm UTC](https://boards.straightdope.com/t/lengthy-complex-password-policies-waste-of-time/734011/23 "2015-10-09T18:45:42Z")
Why would your childhood phone numbers be linked to your name? They would be linked to your guardians. ---
**Author:** ![Little\_Nemo](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/little_nemo/32/3120_2.png) [@Little\_Nemo](https://boards.straightdope.com/u/Little_Nemo)\ **Post date:** [October 9, 2015, 6:47pm UTC](https://boards.straightdope.com/t/lengthy-complex-password-policies-waste-of-time/734011/24 "2015-10-09T18:47:43Z")
I suspect most password policies were created in order to give the people who create password policies something to do. ---
**Author:** ![DrCube](https://avatars.discourse-cdn.com/v4/letter/d/a3d4f5/32.png) [@DrCube](https://boards.straightdope.com/u/DrCube)\ **Post date:** [October 9, 2015, 6:48pm UTC](https://boards.straightdope.com/t/lengthy-complex-password-policies-waste-of-time/734011/25 "2015-10-09T18:48:44Z")
> [@Slash1972](#): > > If only this were possible. almost all logins I have require AT LEAST 1 number, 1 symbol, 1 upper case, and 1 lower case, and most require 2 of each. This is a problem with passwords of the form “correcthorsebatterystaple” that I’d like to start using. But I have a pretty good, memorized formula for creating complex passwords that are all different. My problem is with banks and other websites that supposedly take security seriously telling me I must only use letters and numbers and can’t use any symbols except underscore. Or worse, giving me a 12 character password limit I can’t exceed! That’s when I resort to using “123456seven” as my password and then deleting my account as soon as I’m done. If I really need to use the site, that is. Often when I run across those restrictions, I realize I didn’t need to use that site that bad anyway and just close the tab and never look back. ---
**Author:** ![gazpacho](https://avatars.discourse-cdn.com/v4/letter/g/6f9a4e/32.png) [@gazpacho](https://boards.straightdope.com/u/gazpacho)\ **Post date:** [October 9, 2015, 6:52pm UTC](https://boards.straightdope.com/t/lengthy-complex-password-policies-waste-of-time/734011/26 "2015-10-09T18:52:31Z")
> [@madsircool](#): > > Why would your childhood phone numbers be linked to your name? They would be linked to your guardians. Because that was the phone number you used if you wanted to call me. ---
**Author:** ![gazpacho](https://avatars.discourse-cdn.com/v4/letter/g/6f9a4e/32.png) [@gazpacho](https://boards.straightdope.com/u/gazpacho)\ **Post date:** [October 9, 2015, 7:11pm UTC](https://boards.straightdope.com/t/lengthy-complex-password-policies-waste-of-time/734011/27 "2015-10-09T19:11:36Z")
Just to be clear my child hood phone number is also linked to my parents and my sister. ---
**Author:** ![madsircool](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/madsircool/32/3432_2.png) [@madsircool](https://boards.straightdope.com/u/madsircool)\ **Post date:** [October 9, 2015, 7:23pm UTC](https://boards.straightdope.com/t/lengthy-complex-password-policies-waste-of-time/734011/28 "2015-10-09T19:23:18Z")
> [@gazpacho](#): > > Because that was the phone number you used if you wanted to call me. Then use your parents number. I don’t use numbers connected to my name. ---
**Author:** ![madsircool](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/madsircool/32/3432_2.png) [@madsircool](https://boards.straightdope.com/u/madsircool)\ **Post date:** [October 9, 2015, 7:26pm UTC](https://boards.straightdope.com/t/lengthy-complex-password-policies-waste-of-time/734011/29 "2015-10-09T19:26:45Z")
> [@gazpacho](#): > > Just to be clear my child hood phone number is also linked to my parents and my sister. Use an easily remembered letter prefix. Do you think hackers will specifically target you? ---
**Author:** ![gazpacho](https://avatars.discourse-cdn.com/v4/letter/g/6f9a4e/32.png) [@gazpacho](https://boards.straightdope.com/u/gazpacho)\ **Post date:** [October 9, 2015, 7:38pm UTC](https://boards.straightdope.com/t/lengthy-complex-password-policies-waste-of-time/734011/30 "2015-10-09T19:38:41Z")
> [@madsircool](#): > > Use an easily remembered letter prefix. Do you think hackers will specifically target you? Sure why not? I work in a telecom company. There are news reports of targeted phishing of people who work in telecom companies. These same databases that hold my childhood phone numbers also say who I work for. But your advice was to use something from your childhood that is easily found out by anyone with an internet connection. That is crappy password advice. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [October 9, 2015, 7:41pm UTC](https://boards.straightdope.com/t/lengthy-complex-password-policies-waste-of-time/734011/31 "2015-10-09T19:41:36Z")
> [@](#): > > Quoth **Habeed** , in the OP: > > For an online service done competently, neither should be true. The password hash file should be as well protected as the data the password protects (aka, if hackers can access the file that has the password hash, they can steal everything else anyway), If you do this, then nobody, legitimate or otherwise, can log in. A legitimate user inherently must interact with the password file in some way, because that’s how the system recognizes the user as legitimate. But no user should ever have any kind of access to the protected data before logging in. And length alone is no protection. The only protection is a sufficient amount of randomness. You can increase your randomness by increasing your length, but there still needs to be randomness. This is one of the key points of the correcthorsebatterystaple method that a lot of people miss: The words must be chosen randomly. If you choose your favorite words, or words that make an easy-to-remember sentence, then they’re not random any more, and the system doesn’t work. > [@](#): > > Quoth **steronz** : > > \*Obviously if they know that the site doesn’t allow, say, numbers or special characters in passwords, that’s going to reduce the number of combinations they have to try. But note this is dependent on the site’s policy, not what you actually include in your password. You don’t necessarily need to include special characters or numbers or capital letters, as long as the site permits them and the hacker can reasonably assume that it’s probable that you’ve used at least one of those, they’re going to have to include them in the brute force attack. This is no help. The brute-force attacker isn’t going to try every possible password in random order. They’re going to set up their brute-force generator to generate passwords without the special characters before it generates the ones with them. So even if the site does permit them, and even if most people would be expected to have them, leaving them out will still mean your password is cracked much earlier than others’. ---
**Author:** ![Alley\_Dweller](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/alley_dweller/32/430_2.png) [@Alley\_Dweller](https://boards.straightdope.com/u/Alley_Dweller)\ **Post date:** [October 9, 2015, 7:54pm UTC](https://boards.straightdope.com/t/lengthy-complex-password-policies-waste-of-time/734011/32 "2015-10-09T19:54:42Z")
> [@madsircool](#): > > Then use your parents number. I don’t use numbers connected to my name. Back when dinosaurs still roamed the earth, [phones](http://www.joelonsoftware.com/design/Images/01-BellPhone.PNG) were connected to wires that ran out of the house. onto [big Poles](http://img.bleacherreport.net/img/images/photos/001/666/656/Przemyslaw-Karnowski_crop_north.jpg?w=324&h=215&q=75), and then [ran miles and miles](https://thewiddershins2.files.wordpress.com/2015/09/telephone-poles.jpg?w=480) to the telephone company office. You couldn’t fit them in your pocket and you certainly couldn’t carry them with you (because of the wire, not the weight). Back in those days, most people had [one phone per house](http://rvtravel.com/uploads/1/phone3-476.jpg). The whole family shared the same phone number! Primitive, eh? If you called somebody, you’d have to say something like “Can madiscool come to the phone?” and whoever answered would go get madiscool and tell him to come to the phone. ---
**Author:** ![steronz](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/steronz/32/11765_2.png) [@steronz](https://boards.straightdope.com/u/steronz)\ **Post date:** [October 9, 2015, 8:10pm UTC](https://boards.straightdope.com/t/lengthy-complex-password-policies-waste-of-time/734011/33 "2015-10-09T20:10:23Z")
> [@Chronos](#): > > This is no help. The brute-force attacker isn’t going to try every possible password in random order. They’re going to set up their brute-force generator to generate passwords without the special characters before it generates the ones with them. So even if the site does permit them, and even if most people would be expected to have them, leaving them out will still mean your password is cracked much earlier than others’. See, I think this is exactly the misconception that Randall Munroe was trying to fight. If your password is “onefishtwofishredfishbluefish,” that’s already so difficult to brute force with today’s hardware that what you say won’t even apply. For 8 digits passwords, yes, they’ll probably try all lowercase combinations first, but by the time they get to all combinations of 29 digit passwords, they’ve long since given up and moved on. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [October 9, 2015, 8:22pm UTC](https://boards.straightdope.com/t/lengthy-complex-password-policies-waste-of-time/734011/34 "2015-10-09T20:22:58Z")
Except that if your password is “onefishtwofishredfishbluefish”, you’ll never even get to the brute-forcing stage, because that’ll be caught by a dictionary attack. Now, if you used eight actually random words, then you’re safe, because that’s plenty of randomness even without the special characters. But for a shorter password, the presence of those special characters could mean the difference between “practical” and “practically impossible”. ---
**Author:** ![Baron\_Greenback](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/baron_greenback/32/48_2.png) [@Baron\_Greenback](https://boards.straightdope.com/u/Baron_Greenback)\ **Post date:** [October 9, 2015, 8:35pm UTC](https://boards.straightdope.com/t/lengthy-complex-password-policies-waste-of-time/734011/35 "2015-10-09T20:35:36Z")
> [@Chronos](#): > > Except that if your password is “onefishtwofishredfishbluefish”, you’ll never even get to the brute-forcing stage, because that’ll be caught by a dictionary attack. I’m likely missing something obvious, but how is that 29 character string more vulnerable to a dictionary attack than any other alpha string of the same length? ---
**Author:** ![Canadjun](https://avatars.discourse-cdn.com/v4/letter/c/76d3ee/32.png) [@Canadjun](https://boards.straightdope.com/u/Canadjun)\ **Post date:** [October 9, 2015, 9:11pm UTC](https://boards.straightdope.com/t/lengthy-complex-password-policies-waste-of-time/734011/36 "2015-10-09T21:11:11Z")
> [@Baron\_Greenback](#): > > I’m likely missing something obvious, but how is that 29 character string more vulnerable to a dictionary attack than any other alpha string of the same length? Because it is a well known phrase (from Dr. Seuss if I am not mistaken). A dictionary attack doesn’t need to use a real English dictionary. It simply means that a list of what are assumed to be popular password choices are tested. ---
**Author:** ![Baron\_Greenback](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/baron_greenback/32/48_2.png) [@Baron\_Greenback](https://boards.straightdope.com/u/Baron_Greenback)\ **Post date:** [October 9, 2015, 9:39pm UTC](https://boards.straightdope.com/t/lengthy-complex-password-policies-waste-of-time/734011/37 "2015-10-09T21:39:03Z")
> [@Canadjun](#): > > Because it is a well known phrase (from Dr. Seuss if I am not mistaken). Ah, then that’s the bit I’m missing. 😃 I suppose it’s like someone thinking that “Galadriel69” is in some way secure. ---
**Author:** ![Slash1972](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/slash1972/32/6461_2.png) [@Slash1972](https://boards.straightdope.com/u/Slash1972)\ **Post date:** [October 9, 2015, 10:43pm UTC](https://boards.straightdope.com/t/lengthy-complex-password-policies-waste-of-time/734011/38 "2015-10-09T22:43:39Z")
> [@Alley\_Dweller](#): > > Back when dinosaurs still roamed the earth, [phones](http://www.joelonsoftware.com/design/Images/01-BellPhone.PNG) were connected to wires that ran out of the house. onto [big Poles](http://img.bleacherreport.net/img/images/photos/001/666/656/Przemyslaw-Karnowski_crop_north.jpg?w=324&h=215&q=75), and then [ran miles and miles](https://thewiddershins2.files.wordpress.com/2015/09/telephone-poles.jpg?w=480) to the telephone company office. You couldn’t fit them in your pocket and you certainly couldn’t carry them with you (because of the wire, not the weight). > > Back in those days, most people had [one phone per house](http://rvtravel.com/uploads/1/phone3-476.jpg). The whole family shared the same phone number! Primitive, eh? If you called somebody, you’d have to say something like “Can madiscool come to the phone?” and whoever answered would go get madiscool and tell him to come to the phone. This seems like an urban legend. Do you have any proof of this? ---
**Author:** ![gazpacho](https://avatars.discourse-cdn.com/v4/letter/g/6f9a4e/32.png) [@gazpacho](https://boards.straightdope.com/u/gazpacho)\ **Post date:** [October 9, 2015, 10:50pm UTC](https://boards.straightdope.com/t/lengthy-complex-password-policies-waste-of-time/734011/39 "2015-10-09T22:50:02Z")
> [@madsircool](#): > > Then use your parents number. I don’t use numbers connected to my name. Your parents are connected to your name. ---
**Author:** ![Melbourne](https://avatars.discourse-cdn.com/v4/letter/m/b5e925/32.png) [@Melbourne](https://boards.straightdope.com/u/Melbourne)\ **Post date:** [October 10, 2015, 10:02am UTC](https://boards.straightdope.com/t/lengthy-complex-password-policies-waste-of-time/734011/40 "2015-10-10T10:02:57Z")
I’d turn off my stupid password-complexity requirment, but (on the antique system I have), it’s the only thing preventing users from using their own names as passwords. Fortunately, I’m not in a position where I have to judge who is dumber: people who use their own name as a password, or banks that require less than 9 characters, with no spaces or special characters allowed. [Previous page](https://boards.straightdope.com/t/lengthy-complex-password-policies-waste-of-time/734011.md?page=1) [Next page](https://boards.straightdope.com/t/lengthy-complex-password-policies-waste-of-time/734011.md?page=3)