Excellent rundown of all the horrible rules that organizations impose on your passwords:

  • They donā€™t work.
  • They heavily penalize your ideal audience, people that use real random password generators. Hey guess what, that password randomly didnā€™t have a number or symbol in it. I just double checked my math textbook, and yep, itā€™s possible. Iā€™m pretty sure.
  • They frustrate average users, who then become uncooperative and use ā€œcreativeā€ workarounds that make their passwords less secure.<br />> * They are often wrong, in the sense that the rules chosen are grossly incomplete and/or insane, per the many shaming links Iā€™ve shared above.
  • Seriously, for the love of God, stop with this arbitrary password rule nonsense already. If you wonā€™t take my word for it, read this 2016 NIST password rules recommendation. Itā€™s right there, ā€œno composition rulesā€. However, I do see one error, it should have said ā€œno bullshit composition rulesā€.

My personal pet peeve is forced expiration for no reason. NIST is developing guidelines.