The password that was too strong

An office required passwords of twelve characters with upper case, lower case, digits and symbols, changed every thirty days. Within a year, most were written on paper under keyboards.

The policy was built from a reasonable model of an attacker: someone guessing character by character, for whom each added requirement multiplies the work. It was not built from any model of a user. A person who must invent and memorise a new complex string every month will produce a predictable one — a word, a capital at the front, a digit and a symbol at the end, and the month number — or will write it down. Both responses defeat the policy, and the second defeats it completely.

Current guidance from several national security agencies reverses most of the old advice. Length matters far more than symbol variety, so a passphrase of four ordinary words beats a short string of punctuation. Forced regular changes are discouraged, because they reduce password quality and cause reuse, and a change should be triggered by evidence of compromise instead. Blocking the known-breached passwords catches more real attacks than any complexity rule, because real attackers try lists rather than every combination.

What changed was not the mathematics. It was the realisation that security is a property of the whole system, including the human being in it, and that a rule which is rational against an abstract attacker can be irrational against a real one.

The test for any security measure is therefore behavioural, not arithmetic: what will a tired person do on the third attempt? A policy that has no answer to that question has not been designed, only calculated.