Hackers/crackers use modern GPUs (and possibly ASICs) to brute-force passwords. The old-school password policies from the early 2000’s really shouldn’t apply now, because to a computer, it’s irrelevant which characters are which. Computers can run through the entire UTF-8 charset in fractions of a second, and they’ll eventually guess a short password whether or not it contains a mix of character types (upper, lower, numbers, special, etc).
I’m tired of seeing password policies like this (I saw this when trying to change one of my passwords today):
We require that your new password contain the following:
2 upper case letters
2 lower case letter
2 numbers
2 special characters (examples: !@#$%^&*)
This leads to a false sense of security on both the part of users and the site operators.
Anyone still using/enforcing/advocating this kind of password policy needs to read this (I promise it’s very short).
It doesn’t have to be that complicated. I’ve boiled it down to a 2-step process:
- enforce a minimum password (or passphrase) length, such as 25+ characters
- hash the password using bcrypt or scrypt and store only the hash
Obviously basic steps should be taken, such as preventing passwords from being transmitted in plaintext, but the 2 measures above will prevent 99% of passwords from being cracked.