No to hieroglyphics!
Complex passwords aren't always enough. Discover practical ways to strengthen account security and reduce risks for your business and personal data.
Sur cette page5 sections
Password rules have long focused on complexity. Let's see why length, uniqueness, and good habits protect your accounts better.
Example:
Current standards
Are current password criteria truly effective? These rules emerged over time to counter growing and varied attacks, based on recommendations from cybersecurity experts. However, they often reflect a dated approach that doesn't always account for user behaviour. You know the ones: mandatory capitals, numbers, special characters, and at least 8 characters. These constraints, far from strengthening security, push us toward dangerous habits. Let's look at why these standards don't work and how to replace them with more secure solutions.Isn't it good to have a complicated password?
We reuse them everywhere
Faced with these constraints, what do we all do instinctively? We recycle our passwords. A recent study shows that nearly 60% of users reuse the same password for multiple services, increasing risks in the event of a breach. Let's be honest, how can you remember dozens of incomprehensible combinations? The problem is that this habit creates a massive vulnerability: if a single service is compromised, all our accounts are at risk.We base passwords on personal details
In trying to create something complex yet memorable, we often end up using personal elements: dates of birth, pet names, etc. These choices can be easily guessed by an attacker.How to change this?
Let's talk about brute force
To grasp the importance of a long password, you need to understand how a brute force attack works. This technique, while effective, is just one of many threats. Dictionary attacks or phishing, which exploit common word lists or manipulation techniques, also represent significant dangers. This technique involves testing every possible combination until the right one is found. The shorter a password, the faster it is to crack. Conversely, a long phrase of 20 characters or more exponentially increases the time required to succeed.Example:
- Short password: « P@ss123 »
- Long phrase: « LeChatNoirEstDansLeJardinAvecSaPatteEnL’Air »
Longer = more secure?
Not necessarily, if the phrase is predictable: "MyPassword123" remains easy to guess. It is important to create unique and unlikely phrases.What about OTPs?
One-time passwords (OTP), particularly via SMS, are often presented as a secure alternative. They are popular because they offer an extra layer of protection if the main password is compromised. However, the mobile network is not infallible, and techniques like SIM swapping allow this protection to be bypassed.Changing a password when at risk
Change a password when it has been compromised or a risk is identified, rather than on a fixed schedule. A password manager helps maintain unique passwords.A quick word for my dev friends
Rethinking complexity
Stop forcing arbitrary rules on special characters and focus on the overall quality of the password: its length, uniqueness, and how hard it is to guess.Integrating security reminders
Implement systems that help users react in case of compromise or identified risk, while encouraging them to use password managers.For a more secure web
We must collectively move towards security practices that are both effective and accessible. For example, a password management system integrated into a browser or mobile app would allow users to easily create long, unique passwords while storing them securely.- As users, let's make the effort to adapt our passwords to these new principles.
- As developers, let's integrate systems that meet real security needs without unnecessarily complicating users' lives.
