Why Passwords Fail

Steven Wertheim

Bill Burr, the author of the National Institute of Standards and Technology (NIST) password standards in 2003 (NIST SP 800-63), conceded in an interview with The Wall Street Journal in 2017 that the password paradigm he designed was a failure (Robert McMillan, “The Man Who Wrote Those Password Rules Has a New Tip: N3v$r M1^d!” Aug. 7, 2017, https://on.wsj.com/31M0mi7). The requirements of 8–20 characters, one uppercase letter, one lowercase letter, one special character, not matching the username, not repeating passwords, and changing the password every 30/60/90 days have not only failed to secure user environments; they have led to practices that help bad actors acquire access to the very systems and data that need to be secured.