Password rules were established in the context of past security concerns. Recent work in computer security challenges the conventional wisdom of expert password advice, such as change your passwords often, do not reuse your passwords, or do not write your passwords down. The effectiveness of these rules for protecting user accounts against real world attacks is questioned. We review the latest research examining password rules for general-purpose user authentication on the web, and discuss the arguments behind the continued acceptance or the rejection of the rules based on empirical evidence and solid justifications. Following the review, we recommend an updated set of password rules.

Additional Metadata
Persistent URL dx.doi.org/10.1109/ECRIME.2016.7487945
Conference 2016 APWG Symposium on Electronic Crime Research, eCrime 2016
Citation
Zhang-Kennedy, L. (Leah), Chiasson, S, & Van Oorschot, P. (2016). Revisiting password rules: Facilitating human management of passwords. Presented at the 2016 APWG Symposium on Electronic Crime Research, eCrime 2016. doi:10.1109/ECRIME.2016.7487945