The official password advice changed years ago. Most login forms never got the memo.
NIST — the US standards body a lot of security policy quietly copies — dropped forced periodic password changes and the "must contain an uppercase, a number and a symbol" rules back in 2017, and the current revision goes further and says systems shouldn't impose them at all. The reasoning was simple: those rules don't make passwords stronger, they make them predictable. Force a change every 90 days and you get Summer2026! followed by Autumn2026!. Demand a symbol and everyone puts a ! at the end.
What replaced it is shorter and saner. Allow long passwords, allow spaces and paste so managers work, check new passwords against lists of known-breached ones, and only force a reset when there's actual evidence of compromise.
And yet. Sign up for almost anything and you still get the checklist with little red X's, a 16-character max length (a max length, in 2026), paste disabled on the confirm field, and a work account that expires every quarter.
My guess is it's audit inertia. The old rules are easy to show a checker — "complexity enforced, rotation 90 days" fits in a spreadsheet cell. "We screen against breach corpora" is harder to point at, even though it's the part that actually helps.
Has anyone here managed to get a rotation policy killed at work? Curious what argument actually landed.
0 replies