Password length beats decorative complexity
Adding a capital letter, a number and a punctuation mark to a short password does much less than most people believe.
The rules produced predictable results, because human beings are predictable. Password became Password1, then Password1!. Guessing tools have known that for years. Length is what actually costs an attacker time, which is why the advice moved to long passphrases: three or four unrelated words are both easier to remember and much harder to guess than eight characters of decorative punctuation.
More on Passwords and secrets
- Forced rotation can create predictable passwordsOnly one character moves
- Salts make identical passwords look differentOne grain each
- Every secret copy creates another secret to protectEvery copy needs its own guard
- Secrets in source control have a long memoryThe deletion is just another commit
- Environment variables are not secret vaultsA label on the outside of the bag
- Temporary credentials shrink the theft windowSame theft, different window