Better password policies could result in less credential reuse, academics find

New research points to complex passwords being less used across multiple services

The word password among code

Requiring longer and more complicated passwords could prevent people from using them in multiple websites and online services, according to new research.

According to a research paper from scientists at Indiana University, overcoming password reuse on such services could be easier than imagined. The researchers looked at the password policies of 22 universities in the US as well as 1.3 billion email addresses and passwords obtained from Exploit.in and Anti-Public combination lists.

From the 1.3 billion credentials found in the Exploit.in and AntiPublic datasets there were nearly 7.4 million email addresses associated with .edu domains.

Based on email addresses belonging to academic institutions, passwords were compiled and tested against a university's prescribed password policy. They discovered that longer, more complicated passwords or passphrases are ultimately less likely to be reused on other sites.

"Similar to length, there is a distinct trend towards higher complexity having a lower likelihood of being reused," said the researchers. One of the best performing universities in the research was Indiana University with a password a minimum requirement of 15 characters. This discouraged nearly all its users (99.98%) from reusing the same password on other sites.

"Additionally, we found that the majority of password policies were difficult to very difficult to read and understand according to the Flesch reading scale and typically have a literacy requirement of high school level."

The researchers recommended that organisations should Increase the minimum password length beyond 8 characters; increase maximum password length; disallow the user's name or username inside passwords; and contemplate multi-factor authentication.

"Our recommendations are not only applicable for universities, but also can be used by other organisations, services or applications," researchers said.

Featured Resources

Navigating the new normal: A fast guide to remote working

A smooth transition will support operations for years to come

Download now

Leading the data race

The trends driving the future of data science

Download now

How to create 1:1 customer experiences at scale

Meet the technology capable of delivering the personalisation your customers crave

Download now

How to achieve daily SAP releases

Accelerate the pace of SAP change to support your digital strategy

Download now

Recommended

8 most secure web browsers
web browser

8 most secure web browsers

25 Sep 2020
Your essential guide to internet security
Security

Your essential guide to internet security

23 Sep 2020
How to enable private browsing on any device
privacy

How to enable private browsing on any device

22 Sep 2020
Third-party apps are tracking your WhatsApp activity
social media

Third-party apps are tracking your WhatsApp activity

21 Sep 2020

Most Popular

16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
The Xbox Series X shows how far the cloud still has to go
Cloud

The Xbox Series X shows how far the cloud still has to go

25 Sep 2020