Password security

More outdated knowledge circulates about passwords than about almost any other IT topic. The rule with the special character, the capital and the digit dates from a time when attackers still guessed by hand. Today it is considered obsolete — by the very body that originally set it: length beats complexity, because every extra character multiplies the effort while an appended exclamation mark barely raises it.

The reason lies in how guessing works. Automated attacks do not try character by character; they work from word lists of real languages, names and leaked passwords — including the substitutions everyone thinks of. "P@ssw0rd!" is hard for a person to remember and trivial for a program; four random words are the opposite of both.

The topic only becomes practical with the second question: where do you keep them? A single good password used everywhere stops being a good password the moment one service is breached. A password manager solves that by abolishing the remembering — and moves the question to one master password, which then really does have to be long.

That leaves the single most effective measure: a second factor. It takes effect exactly when the password is already gone — the case in which nothing else helps any more. The articles in this section also explain what happens on the other side: why a service should never store your password in plain text, and how you can tell that it does not.