This is a debate as old as computers themselves. The popular choice for the past ten years or so has been to choose a moderate length complex password. Even Microsoft tries to force domain users in default group policies to use a “complex” password. I agree using more characters is generally a good idea, but I recommend a longer password over a complex one. At NBG Networks we crack a lot of passwords for our customers and from our experience, the longer concatenated words or phrases take us longer to crack. The computing horsepower these days is such that even a 7 or 8 character complex password with numbers and symbols doesn’t take very long to break. Especially when utilizing cloud computing platforms with GPU based cracking techniques.
Users are less likely to write the password down on a sticky note stuck to their monitor when it’s less complex. And a 15 or 16 character password even without symbols is nearly impossible to crack given time and speed constraints.Comic courtesy of xkcd.com
Latest posts by Nick Gibson (see all)
- How Security Professionals Dig up Dirt about You Online - January 20, 2014
- 10 Easy Tips to Secure Home Networks - December 28, 2013
- Network Security Toolkit - December 26, 2013