Do We Really Need Strong Passwords?

Complex passwords don’t usually stop attackers, but they make everyday life much more difficult for computer users, says the UK security agency GCHQ. They recommend using a simpler approach.

GCHQ gives some helpful advice for people who work in IT, as well as normal users. They warn people not to keep their default passwords. They also say that people should avoid storing passwords as plain text because other people, including attackers, can easily read these documents.

The organization says we should stop using too many complex passwords if we don’t want to suffer from 'password overload'. This is what happens when people create too many long passwords for different websites and write them down so they can remember them. Writing down passwords is unsafe.

People often use complex passwords because of organizations’ rules. For example, to be considered 'strong', passwords must be a certain length or include numbers or special characters, like ! or *. Companies should allow people to use their own simpler passwords.

These simple passwords might consist of just three short words, for example. Or people could consider using password managers, software that creates and stores passwords. The passwords might be complex, but people will never need to remember them because their computer will do that for them. Computers don’t mind storing and remembering complex passwords - it’s what they’re designed to do.

The report says that software password managers can help, but, like all security software, they can be hacked and are an attractive target for attackers.