Are Password Rules Making Us LESS Secure?

I'm cancelling all my yahoo email accounts so I don't have to create a new password every time I log in. First they get hacked and don't know it for 2 years...then they go into overkill mode to pretend they have a handle on it. Bye bye YAHOOOOOooooooo.........

More and more people are starting to keep a cheat sheet near their PC as well. That seems to make passwords less secure to me as well.

Marie: I use KeePass - it automatically encrypts the database (I'm sure other password managers do this as well).
Each website still uses a unique password - you only have to remember the master password for your database. Truly, it would be just as secure to make a simple text list of websites and passwords then encrypt that text file - or even keep a printout in a safe location in your own home. It is the convenience of the password manager that I love - I can copy and paste, click and drag, or even auto-fill web-logins. As long as you have one really good secure password (phrase?) to secure your database, you don't really have to worry about it being hacked. Of course, people have different sources of risk - are you at work where someone could literally look over your shoulder? The odds of someone gaining physical access to my home computer are miniscule, and the odds of someone hacking my master password are also. But if you left your password manager open and someone came looking . . . (I know mine can be set to auto-lock after a certain period of inactivity).
One of the big considerations is that if a website gets hacked, a hacker could potentially get your password to THAT site alone, but would not gain anything else (such as your dashlane master password, or any of your passwords to other sites). You can only control security from your end.

Banks usually have small print telling you not to write down your password; to do so would mean they would not accept liability if accounts were hacked. Presumably they would consider password manager programs as being 'written down'. And then, of course, they tell us to make a complicated password, and change it regularly. Easier said than done.

Your article states: "And of course, these rules make it impossible to use password manager tools like LastPass..." I don't understand your thinking. I've been using LastPass for years, and I can stipulate the password length, use of special characters, etc. It seems to me that a password manager would be ideal in this case. My bank's online site won't accept automatic password insertion, but that's fine. I have a secure note in LastPass that I use to copy and paste. It's worth the extra security to do this for a site I only access once occasionally.

Bob the statement "And of course, these rules make it impossible to use password manager tools like LastPass, Roboform or Dashlane that automatically generate and remember secure passwords." is simply false. I've been using Lastpass for years and it generates great passwords based on all said rules. I notice Ralph has had similar results.

Using the usual rules in various combinations, I have remained reasonable secure by including at least one word from a different language. Not a crossover word, like Taco, or a commonly know word like Gracias, but something unusual like tomentosa, (describing the fuzzy nature of some plants, in Latin. If you have a specific ethnic background, use a word from a different language to confuse hackers. So far, I don't believe that hackers have programs that will crack several languages at once in the same password.

Bob,

I continue to be troubled by your advice regarding the use of common words (even many of them strung together) as virtually all password cracking tools are salted with dictionaries which make passwords made up of words very ineffective to prevent brute force hacking. Particularly since there is an equally easy and far more effective method for creating very secure, very hard to brute force, lengthy passwords that are equally easy to remember. Instead of using the actual words of a phrase My_horse_is_named_Ed, instead use the first letter of each word in the phrase - MhinE add a year for example 1970 and then add another phrase I_Dream_of_Jeanie (IDoJ) for example and to maintain a continuity with your phrase or and_no_one_can_talk_to_a_horse_of_course (anocttahoc) so you end up with a password like MhinE_1970_IDoJ or MhinE_1970_anocttahoc.

Now I personally would use two completely unrelated phrases or song lyrics (the more obscure the phrase and/or song the better) and a historical quote and a number unrelated to either for further obscurity and I end up with an easily remembered by me password and yet one that is virtually impossible to end up in any salted Password Breaking Software Dictionary or for anyone else to guess.

I believe password security best practices support this technique far more than the one you mentioned. I realize this may seem overkill, but Password Cracking Software when combined with salted phrases can reveal many passwords by brute force much quicker than most people imagine possible. 20 Characters is a lot but not when the software can search for recognizable or preloaded patterns or words. Using a common special character to separate words makes the task even easier.

Just to clarify, when I say makes the task easier, I mean makes cracking the password easier. And when I say using a common special character, I mean repeatedly using the same special character to separate words or phrases.

One further irritation is when I run into a site that allows you to enter a long password and confirm it. Go to enter it, and bingo! The password is too long to be entered. Guess what? Because the shortened form edition doesn't match the original password on file, you can't log in. If you are lucky, you can get a password reset sent to you, and start over, while remembering the unwritten rules on the web page password entry form!!!!!
Secure order sites have been the worst offenders in my experience.

Please clarify you comment about "LastPass" not working. Thanks.

EDITOR'S NOTE: I overstated the case. I was thinking specifically about sites that require the special character to be in a certain position, such as at the end, or ONLY in the middle of the string.

Re: "Password must contain one uppercase letter"
I've only ever seen "must contain AT LEAST one..."

Robert C., thank you for that suggestion. I have not read all the comments here, but it did occur to me that perhaps the overwhelming criticism of both passwords in general and our host's take on the subject indicates that passwords have been rendered obsolete and that all future tech toys that enable you to shop and reach internet sites should now be equipped with retina scanners. (With practice, even a blind person should be able to scan an eyeball, and then use speech recognition software to talk to his/her pc..."

I would like your opinion on this as an easy to remember password. Let's say you used your father's phone number which is 123-456-7890 but instead of just using the number you use the top row of numbers on your keyboard and hit the shift key every other time (or any pattern you want to use). So your password becomes DaD1@3$5^7*9)

Would using characters that were not on the keyboard slow down the hackers? ☺☻♥♦♣♠•◘○
(These are Alt 1 through Alt 9)

I totally agree that the new password rules make them less secure! I am totally unable to remember the new passwords multiplied by multiple sites requiring them so I am forced to write them down and store them somewhere.

I've seen chats about p/w salts and hashes and tried to understand them. Failed. I am clueless about these terms and what they do,

Use a passphrase as your core password. It must something that will die with you. It must be something you'll never forget even if you get Alzheimers. And no one else knows about it. You never write it down. It really can be just about any length that is allowed for a password. But the passphrase is accompanied by other letters and/or characters but never meaningful words. Your "cheatsheet ' that you keep beside you omits the passphrase. Other information attached to the passphrase can be remembered and thus provide the security and memorability. I am 99 now and I remember 25 or more passwords easily.

Regarding LastPass, I don't use it to generate passwords for me, just to store and access what I create myself. Therefore difficult password rules hindering auto-generation, is not an issue for me.

When it comes to brute force attacks then any upper/lower case letter, number or special symbol is like any other one. It computer terms there is nothing special about a special character, or the case. They are all just numbers representing something the computer doesn't care about.