Better password policies could result in less credential reuse, academics find

New research points to complex passwords being less used across multiple services

The word password among code

Requiring longer and more complicated passwords could prevent people from using them in multiple websites and online services, according to new research.

According to a research paper from scientists at Indiana University, overcoming password reuse on such services could be easier than imagined. The researchers looked at the password policies of 22 universities in the US as well as 1.3 billion email addresses and passwords obtained from Exploit.in and Anti-Public combination lists.

Advertisement - Article continues below

From the 1.3 billion credentials found in the Exploit.in and AntiPublic datasets there were nearly 7.4 million email addresses associated with .edu domains.

Based on email addresses belonging to academic institutions, passwords were compiled and tested against a university's prescribed password policy. They discovered that longer, more complicated passwords or passphrases are ultimately less likely to be reused on other sites.

"Similar to length, there is a distinct trend towards higher complexity having a lower likelihood of being reused," said the researchers. One of the best performing universities in the research was Indiana University with a password a minimum requirement of 15 characters. This discouraged nearly all its users (99.98%) from reusing the same password on other sites.

"Additionally, we found that the majority of password policies were difficult to very difficult to read and understand according to the Flesch reading scale and typically have a literacy requirement of high school level."

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

The researchers recommended that organisations should Increase the minimum password length beyond 8 characters; increase maximum password length; disallow the user's name or username inside passwords; and contemplate multi-factor authentication.

"Our recommendations are not only applicable for universities, but also can be used by other organisations, services or applications," researchers said.

Featured Resources

Top 5 challenges of migrating applications to the cloud

Explore how VMware Cloud on AWS helps to address common cloud migration challenges

Download now

3 reasons why now is the time to rethink your network

Changing requirements call for new solutions

Download now

All-flash buyer’s guide

Tips for evaluating Solid-State Arrays

Download now

Enabling enterprise machine and deep learning with intelligent storage

The power of AI can only be realised through efficient and performant delivery of data

Download now
Advertisement

Recommended

Visit/security/355013/10-quick-tips-to-identifying-phishing-emails
Security

10 quick tips to identifying phishing emails

16 Mar 2020
Visit/business-strategy/mergers-and-acquisitions/354941/panda-security-to-be-acquired-by-watchguard
mergers and acquisitions

Panda Security to be acquired by WatchGuard

9 Mar 2020
Visit/business-strategy/31780/the-it-pro-panel
Business strategy

The IT Pro Panel

24 Feb 2020
Visit/technology/30736/what-is-ethical-ai
Technology

What is ethical AI?

11 Feb 2020

Most Popular

Visit/security/privacy/355155/zoom-kills-facebook-integration-after-data-transfer-backlash
privacy

Zoom kills Facebook integration after data transfer backlash

30 Mar 2020
Visit/infrastructure/server-storage/355118/hpe-warns-of-critical-bug-that-destroys-ssds-after-40000-hours
Server & storage

HPE warns of 'critical' bug that destroys SSDs after 40,000 hours

26 Mar 2020
Visit/software/355113/companies-offering-free-software-to-fight-covid-19
Software

These are the companies offering free software during the coronavirus crisis

25 Mar 2020
Visit/security/cyber-crime/355171/fbi-warns-of-zoom-bombing-hackers-amidst-coronavirus-usage-spike
cyber crime

FBI warns of ‘Zoom-bombing’ hackers amid coronavirus usage spike

31 Mar 2020