Enforcing strong password criteria

You wouldn't think that a benign-sounding topic such as strong password criteria would be so controversial, but it is. The conventional wisdom that you've undoubtedly heard for your entire computer career says:

• Make passwords of a certain minimum length
• Make passwords that consist of a combination of uppercase letters, lowercase letters, numbers, and special characters
• Ensure that passwords don't contain any words that are found in the dictionary or that are based on the users' own personal data
• Force users to change their passwords on a regular basis

But, using your favorite search engine, you'll see that different experts disagree on the details of these criteria. For example, you'll see disagreements about whether passwords should be changed every 30, 60, or 90 days, disagreements about whether all four types of characters need to be in a password, and even disagreements on what the minimum length of a password should be.

The most interesting controversy of all comes from—of all places—the guy who invented the preceding criteria to begin with. He now says that it's all bunk and regrets having come up with it. He now says that we should be using passphrases that are long, yet easy to remember. He also says that they should be changed only if they've been breached.

Bill Burr, the former National Institutes of Standards and Technology engineer who created the strong password criteria that I've outlined earlier, shares his thoughts about why he now disavows his own work.

Refer to: https://www.pcmag.com/news/355496/you-might-not-need-complex-alphanumeric-passwords-after-all.

However, having said all that, there is the reality that most organizations are still wedded to the idea of using complex passwords that regularly expire, and you'll have to abide by their rules if you can't convince them otherwise. And besides, if you are using traditional passwords, you do want them to be strong enough to resist any sort of password attack. So now, we'll take a look at the mechanics of enforcing strong password criteria on a Linux system.

I have to confess that I had never before thought to try creating a passphrase to use in place of a password on a Linux system. So, I just now tried it on my CentOS virtual machine to see if it would work.

I created an account for Maggie, my black-and-white tuxedo kitty. For her password, I entered the passphrase, I like other kitty cats. You may think, "Oh, that's terrible. This doesn't meet any complexity criteria, and it uses dictionary words. How is that secure?" But, the fact that it's a phrase with distinct words separated by blank spaces does make it secure and very difficult to brute-force.

Now, in real life, I would never create a passphrase that expresses my love for cats because it's not hard to find out that I really do love cats. Rather, I would choose a passphrase about some more obscure part of my life that nobody but me knows about.

In any case, there are two advantages of passphrases over passwords. They're more difficult to crack than traditional passwords, yet they're easier for users to remember. For extra security though, just don't create passphrases about a fact of your life that everybody knows about.