A DECADE+ OF STORYTELLING POWERED BY THE BEST WRITERS ON THE PLANET

BE PART OF THE LEGACY

TAMPA BAY • FEBRUARY 23-24 2026

This FINAL encore experience will be unlike any other. Because like everything we do, it's been "reimagined" from beginning to end. It's not a virtual or hybrid event. It's not a conference. It's not a seminar, a workshop, a meeting, or a symposium. And it's not your typical run-of-the-mill everyday event crammed with stages, keynote speeches, team-building exercises, PowerPoint presentations, and all the other conventional humdrum. Because it's up close & personal by design. Where conversation trumps presentation. And where authentic connection runs deep.

The Science Of Choosing Better Passwords

File 20170816 17698 10d1lxq
Make it longer than 12 characters!
selinofoto/Shutterstock.com

Lorrie Cranor, Carnegie Mellon University; Blase Ur, University of Chicago; Lujo Bauer, Carnegie Mellon University; Michelle Mazurek, University of Maryland, and Nicolas Christin, Carnegie Mellon University

For years, computer users have been told they should have complicated passwords, including numbers, punctuation marks and other symbols, and upper- and lowercase letters. Despite those being hard to remember, people were told not to write their passwords down, and forced to make up new ones quite frequently. Users dutifully complied – by capitalizing the first letter of their passwords, adding a “1” or their birth year, or perhaps ending their password with an exclamation point.

Most people couldn’t actually remember lots of passwords without writing them down, so instead they reused a small number of passwords over and over again. And when they were required to change their passwords, they incremented that “1” to a “2” or added another exclamation point. These simple steps to deal with complicated passwords are so common that they actually make it easier for attackers.

As researchers into password security, we’ve known for years that most password advice was not actually based on scientific knowledge. To address this, we have been conducting experiments about the effects of password requirements on security and usability. The federal government recently changed its password recommendations in ways that echo some of our research findings.

Defending passwords from computers

We spent years modeling how different password-cracking approaches work to better understand how attackers guess passwords and to develop an accurate measure of password strength. People who are trying to break into online accounts don’t just sit down at a computer and make a few guesses. Many attackers have been able to steal the entire database of passwords from large companies – for example, this has happened to Yahoo, LinkedIn, Adobe, Ashley Madison and many others. The passwords are scrambled for security, so attackers have to make lots of guesses to unscramble them. But computer programs let them make millions or billions of guesses in just a few hours.

They may start by guessing all the most popular passwords and words in the dictionary, then adding “1” to each of these, and then again with every other digit and symbol, and then with the first letter capitalized, and so on. The end result is that all the complicated password policies don’t prevent – or even really slow down – cracking of many users’ passwords.

Even worse, once an attacker guesses a user’s password for one account, he will often try using that same password on the user’s other accounts. Since users tend to reuse passwords, this can be very successful. An attacker who cracks the password for some website you registered with eight years ago and forgot about may now be able to access your email, your social network account and your bank account.

All this computing power being applied to cracking passwords means users need to go beyond choosing passwords that are hard for a human to guess: Passwords need to be difficult for a computer to figure out.

Testing perceptions of password strength

Our research has informed efforts to teach people how to use this new understanding of password security. More than 50,000 people participated in our online experiments, each creating a password that complied with randomly assigned requirements: for example, “minimum of 12 characters long” or “must include lowercase and uppercase letters, digits and symbols.” We measured the actual strength of the password, a participant’s ability to remember a password a few days later and other metrics. We also analyzed real passwords created by students, faculty and staff at our university.

Our data have shown us that people hold many misconceptions about passwords, such as believing that adding a digit or exclamation point to the end of their password will make it much stronger. This problem is widespread enough that we created an online quiz game to help dispel some of these misconceptions.

In addition, our data have shown us that it is more important to encourage longer passwords (at least 12 characters) than complicated passwords. At the same time, we’ve learned that some users create long passwords that are still predictable – like “passwordpassword” or “xxxxxxxxxxxx.”

We also learned that giving people feedback at the moment they’re creating new passwords can help. Most often this takes the form of what are called “password meters” – color-coded signals that indicate whether a person has chosen a weak password or one that’s very strong.

A password meter provides an opportunity for advice that helps people improve their passwords.
CyLab Usable Privacy and Security Laboratory, Carnegie Mellon University, CC BY-ND

While most password meters on the internet provide inaccurate scores and sometimes questionable advice, we developed a password meter that uses an artificial neural network to compute the strength of those passwords based on an analysis of millions of other passwords. In addition, when it identifies a weak password, our meter provides immediate advice on what would make it stronger. For example, if a person puts all the digits at the end of a password, our system might suggest moving them to the middle.

Creating strong passwords

Our research has led us to develop some specific recommendations for choosing passwords that provide good protection for online accounts and the data they contain. A crucial aid in this process is to use a password manager to generate long, random passwords – and remember them for you.

If you’re making your own passwords:

  • Make your password at least 12 characters, and mix it up with at least two or three different types of characters (lowercase letters, uppercase letters, digits and symbols), put in unpredictable places. Don’t put your capital letters at the beginning or your digits or symbols at the end.
  • Avoid including names of people or pets, places you have lived, sports teams, stuff you like or birth dates. Avoid common phrases (especially anything related to “love” in any language) and song lyrics. Don’t use patterns (“abc,” “123”), including patterns on the keyboard (“1qazxsw2”).
  • One way to make a strong password is to create a sentence that no one’s ever said before and use the first letter or two of each word as your password, mixing in other types of characters.

It may be tempting to reuse your existing passwords, but don’t do it for any accounts you care about. It is better to write your passwords down in a secure place if you have more passwords than you can remember, or better yet, use a password manager.

You can also protect your account without making your password more complicated by using two-factor authentication when it is offered – it’s easier than most people think.

The ConversationPasswords are an annoying part of online life, but they aren’t going away soon. While the password policies of the past decade have caused more user pain than security gain, our research is helping find ways to create passwords that actually work for regular people while keeping us more secure.

Lorrie Cranor, Professor of Computer Science and of Engineering & Public Policy, Carnegie Mellon University; Blase Ur, Assistant Professor of Computer Science, University of Chicago; Lujo Bauer, Associate Professor of Electrical and Computer Engineering and Computer Science, Carnegie Mellon University; Michelle Mazurek, Assistant Professor of Computer Science, University of Maryland, and Nicolas Christin, Associate Research Professor of Computer Science, Carnegie Mellon University

This article was originally published on The Conversation. Read the original article.

THE CONVERSATION
THE CONVERSATIONhttps://theconversation.com/us
THE CONVERSATION US launched as a pilot project in October 2014. It is an independent source of news and views from the academic and research community, delivered direct to the public. Our team of professional editors work with university and research institute experts to unlock their knowledge for use by the wider public. We aim to help rebuild trust in journalism. All authors and editors sign up to our Editorial Charter. All contributors must abide by our Community Standards policy. We only allow authors to write on a subject on which they have proven expertise, which they must disclose alongside their article. Authors’ funding and potential conflicts of interest must also be disclosed. Failure to do so carries a risk of being banned from contributing to the site. The Conversation started in Melbourne Victoria and the innovative technology platform and development team is based in the university and research precinct of Carlton. Our newsroom is based in Boston but our team is part of a global newsroom able to share content across sites and around the world. The Conversation US is a non-profit educational entity.​

DO YOU HAVE THE "WRITE" STUFF? If you’re ready to share your wisdom of experience, we’re ready to share it with our massive global audience – by giving you the opportunity to become a published Contributor on our award-winning Site with (your own byline). And who knows? – it may be your first step in discovering your “hidden Hemmingway”. LEARN MORE HERE


RECIPIENT OF THE 2024 "MOST COMPREHENSIVE LIFE & CULTURE MULTIMEDIA DIGEST" AWARD

WE ARE NOW FEATURED ON

EXPLORE 360° NATION

ENJOY OUR FREE EVENTS

OUR COMMUNITIES