Developer of secure password rules regrets his work

09 Aug 2017

1

Bill Burr, a former manager at the National Institute of Standards and Technology (NIST), who drafted an eight-page guide on how to create secure passwords, called the ''NIST Special Publication 800-63. Appendix A'' today regrets having done so.

The document went on to define password requirements on everything from email accounts to login pages to online banking portal. Blame the annoying rules about using uppercase letters and special characters and numbers to Burr.

Burr had little idea of how passwords worked back in 2003, when he wrote the manual. He was not a security expert, and the 72-year-old bureaucrat is now apologising for what he has done.

''Much of what I did, I now regret,'' Burr told The Wall Street Journal recently, given that his research into passwords mostly came from a white paper written in the 1980s, long before the web was even invented. ''In the end, [the list of guidelines] was probably too complicated for a lot of folks to understand very well, and the truth is, it was barking up the wrong tree.''

But Burr is not wrong, as shorter passwords are easier to crack than a long string of easy-to-remember words. A combination of four simple words can create a passphrase that would take a computer 550 years to guess, while a nonsensical string of random characters would take approximately three days.

Burr wanted to base his guidelines on real world data, but not much data was available at the time. He also tried to get IT administrators at NIST to allow him to look at the passwords on the network, but they would not, over security concerns.

With little to go by, Burr had to rely heavily on a white paper written in the 1980s. The document was written well before the public had access to the internet and it was also a time when cybercrime, as we know it now did not exist.

Business History Videos

History of hovercraft Part 3...

Today I shall talk a bit more about the military plans for ...

By Kiron Kasbekar | Presenter: Kiron Kasbekar

History of hovercraft Part 2...

In this episode of our history of hovercraft, we shall exam...

By Kiron Kasbekar | Presenter: Kiron Kasbekar

History of Hovercraft Part 1...

If you’ve been a James Bond movie fan, you may recall seein...

By Kiron Kasbekar | Presenter: Kiron Kasbekar

History of Trams in India | ...

The video I am presenting to you is based on a script writt...

By Aniket Gupta | Presenter: Sheetal Gaikwad

view more