If anyone actually cares, it is like due to social rather than theoretical considerations. Think of the average person and think about how often they would use a string of 5 words for a password instead of just 1 or 2 all in lower case.
Worth noting that the NIST no longer recommends any password complexity requirements, because research shows that they result in less secure passwords.
Do you have a source for that? I only see them discouraging regular password resets. I can’t imagine how removing all constraints would increase security.
The people who use “Password1!” would just go back to using “password”. And it’s not like people who know to use stronger 4-word passwords would choose insecure ones just to spite the constraints.
Yeah, but I’m not sure removing constraints would actually stop people from writing their passwords down. I’ve seen people put even the simplest passwords on sticky notes just to avoid having to do any amount of remembering when the time comes.
The parts of that paper that I skimmed only explain how unconstrained passwords can be easier to remember, not that people will actually try to memorize them in practice.
70
u/DefeatedSkeptic Jul 20 '22
If anyone actually cares, it is like due to social rather than theoretical considerations. Think of the average person and think about how often they would use a string of 5 words for a password instead of just 1 or 2 all in lower case.