When it comes to composition and length, passwords mostly don't matter
techcommunity.microsoft.com
When it comes to composition and length, passwords mostly don't matter
1–10 of 160 posts
Re: When it comes to composition and length, passwords mostly don't matter
#2> Your password doesn’t matter, but MFA does! Based on our studies, your account is more than 99.9% less likely to be compromised if you use MFA.
I'd be much more interested what that percentage is when you only consider people who use password managers. (Which is not to imply that MFA isn't good.)
Re: When it comes to composition and length, passwords mostly don't matter
#3No, Microsoft. Your password doesn't matter.
Re: When it comes to composition and length, passwords mostly don't matter
#4The conclusion of the article is the exact opposite of the title. As long as it is 9 and over characters and not on password list, it's safe.
There is a rise in sim hacking and still MFA is not a solution if you lose your MFA device. We always go back to passwords, even password resets rely on a password protected email. Until quantum computers make passwords obsolete I have not seen a better solution.
Re: When it comes to composition and length, passwords mostly don't matter
#5If we start thinking passwords don't matter, we go back to single-factor authentication.
What makes the "second" factor in 2FA more secure than the first? Is that it's usually a time-based generated key? Or is it that users usually use a physical device for this second key, hence removing a lot of internet-only attack vectors?
Re: When it comes to composition and length, passwords mostly don't matter
#6Note this is from the perspective of a security decision maker, like an IT administrator. Policy-wise, users can't be forced or trusted to create excellent passwords on their own.
But as an individual, your passwords do matter. It makes a world of a difference to use a password manager and long, completely random passwords - such passwords are immune to all sorts of cracking attempts, and using them can often make MFA unnecessary/redundant (though using MFA always reduces your personal attack surface).
Re: When it comes to composition and length, passwords mostly don't matter
#7> Based on our studies, your account is more than 99.9% less likely to be compromised if you use MFA.
An important thing to remember here is that MFA works with a password. Otherwise, that 99% goes down dramatically because I can just steal your phone/Yubikey/whatever.
This article isn't suggesting that we get rid of passwords. It's suggesting that the energy we spend making sure that passwords are good would be better spent encouraging users to enable MFA.
In other words, having two relatively weak authentication mechanisms that must be used in tandem is still better than having one strong authentication mechanism.
Re: When it comes to composition and length, passwords mostly don't matter
#8Note this is from the perspective of a security decision maker, like an IT administrator. Policy-wise, users can't be forced or trusted to create excellent passwords on their own. But as an individual, your passwords do matter. It makes a world of a difference to use a password manager and long, completely random passwords - such passwords are immune to all sorts of cracking attempts, and using them can often make MF…
Rate-limiting & banning after repeat failed login attempts should be the baseline moat an IT admin or selfhosted infrastructure should have.
Fail2ban rules like "after 5 failed logins, ban for 30min, 10 failed logins in a day (with no succesful login) is a permaban" will curtail most non-spear phishing attacks.
Re: When it comes to composition and length, passwords mostly don't matter
#9Note this is from the perspective of a security decision maker, like an IT administrator. Policy-wise, users can't be forced or trusted to create excellent passwords on their own. But as an individual, your passwords do matter. It makes a world of a difference to use a password manager and long, completely random passwords - such passwords are immune to all sorts of cracking attempts, and using them can often make MF…
Rate-limiting & banning after repeat failed login attempts should be the baseline moat an IT admin or selfhosted infrastructure should have. Fail2ban rules like "after 5 failed logins, ban for 30min, 10 failed logins in a day (with no succesful login) is a permaban" will curtail most non-spear phishing attacks.
A permaban is an awful idea. A legitimate user who forgot their password can easily go through more than 10 failed attempts as they try variations of what they think their own password might be.
"I know I used my usual password, but did it start lower or upper case? Or camel case... did I end it with a number? Did the service require a special symbol, so I added that to the end? Or to the beginning.." - banned.
Re: When it comes to composition and length, passwords mostly don't matter
#10Note this is from the perspective of a security decision maker, like an IT administrator. Policy-wise, users can't be forced or trusted to create excellent passwords on their own. But as an individual, your passwords do matter. It makes a world of a difference to use a password manager and long, completely random passwords - such passwords are immune to all sorts of cracking attempts, and using them can often make MF…
The point of the article is that many common attacks work just as well against completely random, unique passwords as they do against weak/reused ones. If you get phished, it doesn't matter if your password is strong. If your machine has a keylogger on it, it doesn't matter if your password is strong. Etc.
Lots of attacks boil down to the attacker convincing you to unknowingly divulge your password, and if that password is the only thing securing your account, you're boned no matter how strong it is.