Six pieces of password advice that quietly stopped being true

Password guidance changed substantially over the last decade, and the change ran in an unusual direction: the new rules ask less of people than the old ones did. The reasoning is that rules people cannot follow produce worse security than looser rules people actually keep, because a rule that is too demanding gets satisfied on paper and defeated in practice. When the federal digital identity guidance maintained by the National Institute of Standards and Technology was rewritten along those lines, most of the advice that had filtered down to ordinary users through the 2000s was left behind, and it has gone on being repeated anyway.

Six specific pieces of that older advice are worth retiring by name.

1. A password should be changed every ninety days

Expiry on a calendar was near universal in workplaces, and current guidance discourages it unless there is some reason to think the password has been exposed. The reason is behavioral. Asked for a new password four times a year, almost nobody invents four strong ones. They edit the one they already have, and Winter24 becomes Spring24. The exercise costs everybody time and ends in a password that anyone holding the previous one could work out.

The current position is to change a password when there is a reason to: a breach notification, a shared device, a suspicion. Otherwise leave a strong unique password alone.

2. Mix uppercase, numbers and symbols

Composition rules were meant to force variety. What they actually produced was a small number of predictable patterns, because people satisfy them the same way. A capital at the front, a number at the end, and an exclamation point after that. Attackers know this, and their guessing tools model it directly.

Length does more than composition. A passphrase of four or five unrelated words is longer, easier to remember and harder to guess than a mangled eight character word, even though it looks less complicated to a human eye.

3. Never write a password down

This advice made sense when the realistic threat to a home user was a person in the room. For most people it is not. The realistic threat is credential reuse: one site is breached, and the same email and password combination is tried everywhere else.

A password written in a notebook kept in a drawer at home defeats remote attacks completely, which is the attack that actually happens. A password manager is better still, because it also fills credentials only on the site they belong to and so declines to hand your password to a convincing imitation. But a notebook and a hundred different passwords beats one memorized password used everywhere by a wide margin.

4. A strong enough password is all you need

Of the six items here, this is the one worth acting on even if you ignore the rest. Second factor authentication means a password plus something else: a code from an app, a tap on a phone prompt, or a physical key. It stops the entire category of attack where someone has your password and you do not know it yet.

The forms are not equal. A code sent by text message is meaningfully weaker than one generated by an app, because phone numbers can be moved to another device by someone who talks their way past a carrier. An app based code is good. A hardware key is better and is the only form that fully resists a convincing fake login page.

5. Security questions add a layer underneath the password

Look at what they ask for. A mother's maiden name, a first pet, a high school. None of that is secret. It is biography, published somewhere more often than not, and where it is not published it can be guessed or worked out by anyone who knows you. What the site has installed is a second and weaker password that also works as a way around the strong one.

Where a site insists on them, treat the answers as passwords rather than as questions. Store an unrelated random string in your password manager as the answer. The site does not check whether you actually had a dog.

6. Your backup is fine because it ran

Not a password rule exactly, but it belongs on the same page, because backups are what make a compromised account survivable. A backup job that reports success every night has proved that it can write. It has not proved that it can restore, that the files inside are readable, or that it is capturing the folder you actually care about.

Test it. Once a quarter, pick a real file from a month ago, restore it somewhere harmless, and open it. Also confirm at least one copy is somewhere a problem on your computer cannot reach, which means offline or in an account with separate credentials. Ransomware and a failed drive both take the connected copy with them.

What to actually do this week

Three things, in order. Turn on app based second factor for your email account first, because email is the reset mechanism for everything else you own. Then install a password manager and let it generate new passwords for your bank and any account holding a stored card. Then restore one file from your backup and open it.

That is an evening's work and it retires all six of the habits above at once. The newer guidance is not merely more current. It asks you to remember one strong passphrase instead of forty mediocre ones, which is why it holds up over years in a way the old rules never did.