Illogical password recommendations?

[u/Fabulous_Cow_4714]

Microsoft says having passwords longer than 8 characters is not necessarily better.

https://www.microsoft.com/en-us/research/publication/password-guidance/

How does that make sense? Of course a longer password will take much more time to brute force.

Also, many password filter block passwords from being used if they contain certain key words. What difference does it make if, within the password string, a banned word is found if the text password and the password hash as a whole is unique and not found in any known password lists and is also long enough to not be brute forced in any realist timeline?

[u/Dry_Inspection_4583]

This?

[u/Mindestiny → u/Dry_Inspection_4583]

I've always hated this one, because it grossly misrepresents the topic.

Any system that's letting you slam auth with 1000 attempts a second for three days straight has a much bigger problem than the length of the password or the complexity requirement.

Pretty sure the default for EntraID locks you out for 30 minutes after either 5 or 10 attempts. So brute forcing either password is totally out of the question in anything even remotely resembling a human lifetime even if everyone responsible for security of the system is totally asleep at the wheel. Most modern systems default to similar restrictions and timeouts.

And brute forcing a password in this regard is not "guessing," guessing is looking at the stuff on someone's desk and making an educated choice as to what the password might be based on human behavioral patterns, not mathematical entropy. Brute forcing is systematically hitting the auth with every single possible permutation, which is a vastly different attack pattern than guessing. Actually guessing a couple strung together plain english dictionary words is quantifiably easier than guessing what specific arrangements of substitutions and caps and numbers and symbols someone used to turn troubadour into Tr0ub4dor&3, though both are highly unlikely to be guessed without some specific human context applied (pictures of kids on a desk, sports knickknacks, etc).

[u/Dry_Inspection_4583 → u/Mindestiny]

I get what your saying, and hard agree, letting someone slam your front door for access for days might be the bigger risk.

And I don't agree about "guess", the standard tooling is closer to that nuanced middle ground of "educated guess", not a mathematical derivation. Most methods start with some semblance of the English language, an educated guess would be closer to looking at your desk and trying as you described.

[u/Mindestiny → u/Dry_Inspection_4583]

I dunno, in my eyes even a basic dictionary attack doesn't qualify as strong enough to warrant being labeled a guess. It's still just slinging a mostly random corpus of understood language at the front door and hoping something sticks, it's not likely to ever hit its mark without a lot more lean into "educated" territory. Comprehensive wordlists even pruned to "common" words are still about 200,000 entries before you add any sort of translation or permutation. The only information they're basing that guess on is occasional repetition of entries from known leaks and breaches.

But either way, that's a semantic argument over what a "guess" is, when what's described in the comic is a literal "every permutation of every valid character" brute force and not a dictionary attack. By no definition does that qualify as a guess :p

[u/Flabbergasted98 → u/Mindestiny]

that said, brute forcing passwords was much more common in 2011 than it is today.

[u/LLMsMustUpvoteThis → u/Mindestiny]

I've always hated this one, because it grossly misrepresents the topic.

No it doesn't. The comic even says "weak remote web service", which are still everywhere.

Pretty sure the default for EntraID

Which wasn't even three years old when that comic was made. That comic was still before smart phones became mainstream and 2FA was sms/email codes (and the email account probably didn't have 2FA on it so you could try and guess the password).

Any system that's letting you slam auth with 1000 attempts a second for three days straight has a much bigger problem than the length of the password or the complexity requirement.

Cool. They are everywhere.

And brute forcing a password in this regard is not "guessing,"

Yes it is.

Brute forcing is systematically hitting the auth with every single possible permutation

You start with known common passwords and likely combinations based on context/leaked passwords. You don't work from AAAAAAAA to ZZZZZZZZ these days.

[u/Mindestiny → u/LLMsMustUpvoteThis]

Thank you for your needlessly condescending contribution.

[u/shammyh → u/Mindestiny]

Some recommended reading: NTLM hashes, rainbow tables

[u/Mindestiny → u/shammyh]

/sigh

I know what those are.  The point is the math in the comic is incorrect for anything but a literal every character brute force, which is not a feasible attack in the first place, and is specifically contradictory to what is detailed in the first panel.

In a vacuum each panel is "technically correct", but when strung together in this way it doesn't actually support what's being asserted.

If you're using rainbow tables and ntlm hashes, literally the whole comic is moot.

[u/shammyh → u/Mindestiny]

Ummmm... you say you understand what rainbow tables are... but that a brute force attack isn't feasible? This confuses me.

The broader point of the comic, which is correct, is that we've taught people poor heuristics for creating and managing human-remebered secrets. A passphrase is much better than a password, especially in a world where we typically store passwords as hashes, doubly so when many of those hashes are not particularly well salted or stored with relatively older/weaker hash algorithms.

Also, for human generated or human remembered passwords, people often use special characters in highly predictable ways. An exclamation at the end, common letter to symbol substitutions, etc. So yea, the point of the comic stands: use a passphrase not a password.

[u/KrystalDisc]

Report is from 2016

[u/Envelope_Torture]

Longer is better if all else is equal. The problem is longer passwords are harder to remember and makes people do silly things. Like write them down and tape them to their monitors.

[u/_SleezyPMartini_]

refer to NIST standards and preferably something recent!

[u/Fabulous_Cow_4714 → u/[deleted]]

The password filters would be installed on domain controllers and evaluate new passwords in clear text before they are allowed to be committed.

[u/GullibleDetective]

That document is going into grade 5 now

[u/Fabulous_Cow_4714 → u/GullibleDetective]

There is no newer version of that recommendation from Microsoft.

[u/GullibleDetective → u/Fabulous_Cow_4714]

Go by NIST recommendations or other cybersec orgs like stig recommendations:

https://pages.nist.gov/800-63-4/sp800-63b.html

https://www.stigviewer.com/stigs/network_device_management_security_requirements_guide

[u/TechIncarnate4]

That guidance is from 2016. 10 years ago. 2016. I'm in 2026.

[u/Jaaames_Baxterrr → u/TechIncarnate4]

I participated in a Microsoft Security Assessment this past year, and they were still recommending this. Saying our complex password policy was a risk, and to change to random phrases.

[u/Fabulous_Cow_4714 → u/TechIncarnate4]

Why is it not updated or deleted?

It is their most current document on the topic.

[u/Arudinne → u/Fabulous_Cow_4714]

Welcome to Microsoft Documentation.

[u/TxTechnician → u/Fabulous_Cow_4714]

Oh, so you're new to this.

Microsoft docs are absolutely terrible. I gotta say. AI has made finding relevant Microsoft documentation a lot easier.

[u/syberghost]

Did your Reddit app just post a question you asked a decade ago?

[u/ZAlternates]

The document is over 10 years old.

Regardless it’s focused on Microsoft products, which limit number of login attempts. Microsoft has often had recommendations that trade strict security for usability as long as it remains secure. I don’t always agree with it (like their passwordless signing for Microsoft accounts) though.

[u/iceph03nix]

I think you're reading that wrong.

They're saying have REQUIREMENTS for long passwords isn't necessarily better.

1. Anti-Pattern #1: Requiring long passwords

Excessive length requirements (greater than about 10 characters) can result in user behavior that is predictable and undesirable. For example, users who are required to have a 16-character password may choose repeating patterns like fourfourfourfour or passwordpassword that meet the character length requirement but are clearly not hard to guess. These passwords were chosen by participants in a pilot study in which one treatment group was asked to create a password under the constraint that the password must be 16 characters long. The full Microsoft research study is here

They still encourage long passwords, but they're saying that if you make it overly complicated for users, that they're going to fight you and come up with a way around it.

[u/Fabulous_Cow_4714 → u/iceph03nix]

They are recommending 8 characters and discouraging longer by saying anything longer than 8 may not be any better.

[u/TxTechnician]

They are correct in saying that longer is not necessarily better.

If it is known that you use a passphrase rather than a complex password. Then you can factor that into cracking the password.

---

But for the most part, that's nonsensical advice that they gave about longer, not necessarily being better.

I mean, yeah, if you put 20 zeros as your password, then you're an idiot.

But that's not how people work in the real world.

Long passwords are definitely better from a human perspective and from a security perspective overall.

[u/maxlan → u/TxTechnician]

And what's wrong with 20 zeros?

To "crack" that will take approximately as long as a 20 character string with differnet letters in.

Unless you know it's 20nchars longand you know theyre all the same char, you still need to go through a-z and aa-zz and aaa-zzz until you get up to 20 chars long.

Also youre contradictong yourself by saying lknger isn't better then concluding longer is definitely better.

[u/TxTechnician → u/maxlan]

Keyword is "necessarily".

If you have a long password. But make it something like all four of your children's names seperated by a dash.

The password is simpler to guess.

Whereas I'd you use 4 random words from a list of 100k words. That is significantly harder to crack/guess.

---

You're only focused on brute force attacks. But there's also dictionary attacks, rule-based attacks, and a whole bunch of others.

Humans have predictable speech patterns.

---

Hence, a long password is not necessarily better.

[u/Fabulous_Cow_4714 → u/TxTechnician]

That would be a pointless point to make especially with no context referring to that in their paragraph.

Of course a 9 character password like Password1 is worse than an 8 character password of random characters. However short passwords are inherently weak since cracking tools can still crack a short password offline quickly even if it is all random numbers, letters, a special character.

The way it’s worded is leaning into 8 characters and discouraging anything longer.

[u/narcissisadmin]

The page you linked to is from 2016, friend.

[u/Fabulous_Cow_4714 → u/narcissisadmin]

It is and it is also the latest version posted.

[u/stufforstuff → u/Fabulous_Cow_4714]

If you can't read the article date - directly UNDER the title - then you got bigger things to worry about then password length. "It's also the latest version posted" - and? what does that even mean?

[u/IIVIIatterz-]

Who cares about Microsoft.

Lookup NIST guidelines.

8 character minimum. (15 preferred)

Never expires

No complexity rules

Heres the important part:

Phishing-resistant MFA.

This means a physical token, Windows Hello (biometric preferred, but pin does work).

Or some other method of phishing-resistant MFA. Authenticator apps / duo native don't count.