The article is correct, most password policies are dumb. But it's arguing about one tree while standing in a forest.
The real problem with passwords is not individual policies, but rather their shere volume. In my password manager I noticed I have got literally hundreds of the things.
Clearly reusing a password on multiple systems is bad. Clearly memorizing more than a handful is impossible. Since I therefore am using a password manager anyway, I simply get it to generate long, random, strings. Which inevitably contain enough to satisfy most daft policies.
There are some I still type. Basically the ones I use everyday, like machine login, but 99% are generated.
I get the article, and for those everyday passwords I advocate the same - make it long, make it easy to type, don't change it.
But if a Web-site wanted to be really secure, require a password manager. (how? I've no idea...)
The real problem with passwords is not individual policies, but rather their shere volume. In my password manager I noticed I have got literally hundreds of the things.
Clearly reusing a password on multiple systems is bad. Clearly memorizing more than a handful is impossible. Since I therefore am using a password manager anyway, I simply get it to generate long, random, strings. Which inevitably contain enough to satisfy most daft policies.
There are some I still type. Basically the ones I use everyday, like machine login, but 99% are generated.
I get the article, and for those everyday passwords I advocate the same - make it long, make it easy to type, don't change it.
But if a Web-site wanted to be really secure, require a password manager. (how? I've no idea...)