Last week, I signed up on a new web forum. On registration, the following text popped up:
To enhance our site security, your password must be a minimum of eight characters long, contain one upper case letter, a number and a special character.
I signed up for the site, but wondered later just how much more effective this style of password was. I’ve seen that same text on multiple sites and where I work, we have the same password policy in place. I simply wanted to see how much more effective that enforced password policy was. Plus, I wanted to confirm that we were taking proper steps to protect our users.
I composed the below Excel chart over a lunch break and the results shocked me. While a “perfect” password had over six quadrillion combinations, a policy enforced password of the type described above was actually less than half as good as a purely lower case one that we’d been warned against using.
As a simple example, the entirely lower case password robocat is more than twice as effective as $5Montyz
I ran a series of combinations and found overall that passwords where content was not dictated by policy were more effective than those that were.
I had a hard time seeing the overall impact, so I added a money column as everyone can relate to cash. If a perfect password was worth $100,000 then a policy enforced password was only valued at $1.62 where an entirely lower case password was equivalent to $3.43.
Random generation of a password is the typical way to get around this. However, a password of R#<,.mL6 will only result in it being written onto a sticky note then being placed on their monitor.
To generate a password of reasonable effectiveness (and also being user friendly) an upper and lower case password should be used in place of a policy dictated one. Plus, a longer password or passphrase would be much better than a short one.
Using the same logic as above, the passphrase MyCatIsQuiteCute a sixteen character upper and lower case password would be worth $46,884,649,035,711,300.
NOTE: This is by no means an exhaustive analysis. This is a oversimplified demonstration based purely on the mathematical number of possible combinations. Many other factors would come into play in real life.
(Click on below image to load larger version)
RSS Feed