# Lengthy/complex password policies : waste of time? **URL:** \ **Category:** Factual Questions\ **Created:** [October 9, 2015, 9:23am UTC](https://boards.straightdope.com/t/lengthy-complex-password-policies-waste-of-time/734011 "2015-10-09T09:23:10Z")\ **Posts on this page:** 8\ **Page:** 4
**Author:** ![ftg](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ftg/32/2801_2.png) [@ftg](https://boards.straightdope.com/u/ftg)\ **Post date:** [October 11, 2015, 12:12pm UTC](https://boards.straightdope.com/t/lengthy-complex-password-policies-waste-of-time/734011/61 "2015-10-11T12:12:24Z")
> [@steronz](#): > > I should add, in the attack I described it’s unlikely that the hacker would be trying to get the password for any specific user. Rather, he’s trying to crack the .01% of passwords that are terrible, which will still probably yield him thousands of user accounts. … This is also a factor in the weakness of the 10 tries before lockout mentioned in the OP. You can go thru all accounts, trying 10 times each with a mix of dictionary and short passwords. Without some sort of password strength requirement, you’re going to get into a lot of accounts. Note that a site might notice a lot of tries coming from one IP address and block that one. (Although maybe there’s just a lot of users coming in from behind one company’s NAT router.) But a botnet will get around that. Note also, the botnet can be working against thousands of sites. Companies aren’t trying to protect _your_ account. They are trying to avoid the headaches _for them_ caused by thousands of users with bad passwords. ---
**Author:** ![ftg](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ftg/32/2801_2.png) [@ftg](https://boards.straightdope.com/u/ftg)\ **Post date:** [October 11, 2015, 12:16pm UTC](https://boards.straightdope.com/t/lengthy-complex-password-policies-waste-of-time/734011/62 "2015-10-11T12:16:24Z")
(Also noticing 2nd page.) Regarding similarity of passwords: 1. A good hashing function is strictly one-way. If a password can be decrypted by the site then it is run by idiots. Someone, perhaps an insider, can get the password file and the key and go to town. 2. Ever notice a site asking you the old password before allowing you to change your password? It saves the old one plain text for a bit to compare to your new password. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [October 11, 2015, 9:25pm UTC](https://boards.straightdope.com/t/lengthy-complex-password-policies-waste-of-time/734011/63 "2015-10-11T21:25:11Z")
A site always needs to ask you for your old password before changing it, even if it isn’t comparing it to the new one. If they didn’t, then it’d be trivial for attackers to get in just by changing the password to something they know. ---
**Author:** ![Canadjun](https://avatars.discourse-cdn.com/v4/letter/c/76d3ee/32.png) [@Canadjun](https://boards.straightdope.com/u/Canadjun)\ **Post date:** [October 12, 2015, 12:38pm UTC](https://boards.straightdope.com/t/lengthy-complex-password-policies-waste-of-time/734011/64 "2015-10-12T12:38:29Z")
> [@Chronos](#): > > A site always needs to ask you for your old password before changing it, even if it isn’t comparing it to the new one. If they didn’t, then it’d be trivial for attackers to get in just by changing the password to something they know. Only if the attacker is able to get at your account when it is already signed on; otherwise they won’t (or shouldn’t) be able to get to the prompt for changing the password. That said, it is a good feature for situations where people stay signed on without necessarily being at their keyboard every minute even though other people are physically nearby. ---
**Author:** ![OffByOne](https://avatars.discourse-cdn.com/v4/letter/o/45deac/32.png) [@OffByOne](https://boards.straightdope.com/u/OffByOne)\ **Post date:** [October 13, 2015, 3:00pm UTC](https://boards.straightdope.com/t/lengthy-complex-password-policies-waste-of-time/734011/65 "2015-10-13T15:00:24Z")
> [@madsircool](#): > > An easy and easy to remember long password would be capital A plus a childhood phonenumber and area code you remember. Make it just about impossible to crack by using three old phone numbers. My childhood phone number was two longs and a short. (Or was it two shorts and a long?) ---
**Author:** ![ftg](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ftg/32/2801_2.png) [@ftg](https://boards.straightdope.com/u/ftg)\ **Post date:** [October 14, 2015, 9:11pm UTC](https://boards.straightdope.com/t/lengthy-complex-password-policies-waste-of-time/734011/66 "2015-10-14T21:11:52Z")
One thing to keep in mind is that no non-trivial software is perfect. Flaws against password checking systems are found all the time. (Reading Slashdot regularly will easily persuade you of this.) One relevant recent post they had was to [this](https://blog.sucuri.net/2015/10/brute-force-amplification-attacks-against-wordpress-xmlrpc.html) article about brute force amplification of attacks on WordPress. Turns out, you can do hundreds, maybe a thousand _simultaneous_ password attempts in a single login try due to parallel execution of the checking method. Having a lousy WordPress password greatly increases your chances of getting cracked. Don’t trust the site to have all that great of software/people. Do the best at your end. Let’s be careful out there. ---
**Author:** ![Voyager](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/voyager/32/133_2.png) [@Voyager](https://boards.straightdope.com/u/Voyager)\ **Post date:** [October 14, 2015, 10:05pm UTC](https://boards.straightdope.com/t/lengthy-complex-password-policies-waste-of-time/734011/67 "2015-10-14T22:05:27Z")
> [@gazpacho](#): > > Sure why not? I work in a telecom company. There are news reports of targeted phishing of people who work in telecom companies. These same databases that hold my childhood phone numbers also say who I work for. > > But your advice was to use something from your childhood that is easily found out by anyone with an internet connection. That is crappy password advice. If you are Hillary Clinton or the head of a movie studio who just pissed off the North Koreans, and someone is specifically targeting you, you are in far more danger than if you are some random shnook. My childhood phone number has long since been given to someone else. I wouldn’t use it, but it would be reasonably difficult for someone to get it on the internet. Or impossible - numbers were not portable when my parents moved. My passwords are memorable non-words with number and character substitutions for some letters. And they are long enough. ---
**Author:** ![Steve\_MB](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/steve_mb/32/5339_2.png) [@Steve\_MB](https://boards.straightdope.com/u/Steve_MB)\ **Post date:** [October 14, 2015, 10:45pm UTC](https://boards.straightdope.com/t/lengthy-complex-password-policies-waste-of-time/734011/68 "2015-10-14T22:45:40Z")
The strategies I use are: 1. Use a password manager. That way, you only need to memorize one password and can access the others as needed. 2. Use acronyms as memory prompts to reliably memorize semi-random character strings (not truly random because some first letters are more common, but good enough for the purpose of defeating dictionary attacks). This gives you most of the strength of a moderately long phrase in a password that fits in a dozen-or-so character limit. [Previous page](https://boards.straightdope.com/t/lengthy-complex-password-policies-waste-of-time/734011.md?page=3)