When it comes to passwords, complex is not always safer, new study shows
By Stuart Layt
Passwords comprising complex strings of numbers and characters are hard to remember but relatively easy to hack, research has confirmed.
For a long time password strength was measured by how complex a password was, such as whether it included both upper and lower-case letters, numbers and special characters, such as ampersands and dollar signs.
New research has confirmed that forcing users to create complex passwords can make them more vulnerable to hacking. Credit:Reuters
However, cybersecurity experts are increasingly moving away from these complex passwords to ones that seem more simple but are actually harder for hackers to crack.
Researchers from James Cook University found users were far more likely to engage in unsafe cybersecurity behaviour if forced to keep creating complex passwords by overzealous IT managers.
Associate Professor Roberto Dillon conducted a survey in which users were asked to create increasingly complex passwords, then, in a separate survey, they were asked about their usual password habits online.
Professor Dillon said that in 75 per cent of cases, users used various strategies to remember passwords, many of which compromised their data security.
“The most popular strategy was using the same password for multiple sites,” he said.
“Our results confirm that the tougher the constraints on creating the passwords, the safer users feel with their information. However, the results show that a large number of restrictions can frustrate users.”
Professor Dillon said the research confirmed what was becoming mainstream theory among data security experts – when it comes to passwords, complex is not always better.
One of the most common ways to crack a password is the “brute force” method, where a hacker sets up a computer program to rapidly guess as many character combinations as it can until it guesses the password.
As a result, many companies insist that their employees use complex passwords, however if they’re still relatively short, they can be cracked.
Instead of an extremely complex but relatively short password, for example “TvU4E#k&“, Professor Dillon suggested using a short phrase, for example “sunlightautumnleaves”.
“This is easy to remember but long enough to hinder brute-force hacking attacks,” he said.
“At the same time, providers should avoid adding several restrictions as it makes it more likely for users to resort to workarounds that compromise security.”
A number of recent major data breaches online have seen thousands of passwords made public.
Data breaches are a common occurrence online, with old password databases often leaking out to communities of people who can use the data to try to take over accounts.
Facebook recently announced account information from more than 500 million of its users had been leaked online, prompting calls from experts for users to secure their accounts by changing their passwords.
Some people use password manager programs, which store multiple passwords, allowing users to remember just one, however even they aren’t immune to hacks, with company Passwordstate announcing this month that hackers had stolen users’ data.
A number of legitimate sites can tell people whether their data has been part of a recent hack, including haveibeenpwned.com, where users can enter their email address and see if their passwords have been made public.
The research has been published as part of the 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom).
Stuart Layt covers health, science and technology for the Brisbane Times. He was formerly the Queensland political reporter for AAP.