Rules for strong passwords don’t work, researchers find. Here’s what does

Secret password written on hand

Adding numbers at the end of a password isn’t good enough, because you’ll likely just add a 1. Researchers at Carnegie Mellon University developed tools to prompt you to create a strong password you can remember.


Stephen Shankland/CNET

When you create a password for yet another new account, you’ll probably encounter familiar rules designed to make it harder for hackers to get in: Use capitals letters, numbers and special characters. However, researchers at Carnegie Mellon University say these requirements don’t make your password stronger.

Lorrie Cranor, director of the CyLab Usable Security and Privacy Laboratory at CMU, says her team has a better way, a meter that websites can use to prompt you to create more-secure passwords. After a user has created a password of at least 10 characters, the meter will start giving suggestions, such as breaking up common words with slashes or random letters, to make your password stronger. 

The suggestions set the password strength meter apart from other meters that provide an estimated password strength, often using colors. The suggestions come from common pitfalls Cranor’s team has seen people make when they set up passwords during experiments run by the lab.

One of the problems with many passwords is that they tick all the security checks but are still easy to guess, because most of us follow the same patterns, the lab found. Numbers? You’ll likely add a “1” at the end. Capital letters? You’ll probably make it the first one in the password. And special characters? Frequently exclamation marks.

CMU’s password meter will offer advice for strengthening a password like “ILoveYou2!” — which meets the standard requirements. The meter also offers other advice based on what you type in, such as reminding you not to use a name or suggesting you put special characters in the middle of your password. 

“It’s relevant to what you’re doing, rather than some random tip,” Cranor said. 

In an experiment, users created passwords on a system that simply required them to enter 10 characters. Then the system rated the passwords with the lab’s password strength meter and gave tailored suggestions for stronger passwords. Test subjects were able to come up with secure passwords that they could recall up to five days later. It worked better than showing users preset lists of rules or simply banning known bad passwords (I’m looking at you “StarWars”).

Cranor and co-authors Joshua Tan, Lujo Bauer and Nicolas Christin will present their latest password findings on Thursday at the ACM Conference on Computer and Communications Security, which is being held virtually. The team hopes its tools will be adopted by website makers in the future.

In the meantime, Cranor says the best way to create and remember secure passwords is to use a password manager. Those aren’t widely adopted, and they come with some trade-offs. Nonetheless, they allow you to create a random, unique password for each account, and they remember your passwords for you.

Source Article