The Password Mess: Your Security Policies Are Destroying Your Users

We've all seen the requirements. Your password must contain upper and lower case, be between 6 and 23 characters long, and must contain at least one Beatle. And you need to pick a new one on a regular schedule, even if you don't use the site that often. Everybody hates it, and it turns out that these rules do not make it harder for attackers. 

How did we get into this mess? We'll take a look at the history of passwords, the attacks we thought we were protecting against, the attacks we actually need to protect against, how people made everything worse, and how we can make it better.

Key Takeaways:

- Passwords aren't being used for what they're good for, and we need to change that

- Password rules as seen today make for bad passwords, and we can do better

- People will find ways around your arcane policies