Site sur mesure pour TPE : est-ce vraiment réservé aux grandes entreprises ?
J'aime parler de choses intéressantes, dev ou pas, ça peut peut-être vous plaire ?
Current standards
Are current criteria for passwords really effective? These rules emerged over time to counter increasing and varied attacks, relying on recommendations from cybersecurity experts. However, they often reflect a dated approach that doesn't always take user behaviour into account. You know, those famous rules imposed by most online services: mandatory capital letters, numbers, special characters, and at least 8 characters. These constraints, far from strengthening security, push us to adopt dangerous habits. Let’s see why these standards don't work and how to replace them with more secure solutions.Is it not good to have a complicated password?
We reuse it everywhere
Faced with these constraints, what do we all instinctively do? We recycle our passwords. A recent study shows that nearly 60% of users reuse the same password for several services, thus increasing risks in case of compromise. Because let's be honest, how can one remember dozens of incomprehensible combinations? The problem is that this habit creates a huge vulnerability: if a single service is compromised, all our accounts are at risk.We base our password on personal aspects
In trying to create something complex but memorable, we often end up using personal elements: date of birth, name of a pet, etc. These choices can be easily guessed by an attacker.How to change this?
Let's talk about brute force
To fully grasp the importance of a long password, one must understand how a brute force attack works. This technique, although effective, is only one of many threats. Dictionary attacks or phishing, which exploit lists of common words or manipulation techniques, also represent significant dangers. This technique consists of testing all possible combinations until finding the right one. The shorter a password is, the faster it is to crack. Conversely, a long phrase of 20 characters or more exponentially multiplies the time needed to achieve it.Example:- Short password: « P@ss123 »
- Long phrase: « TheBlackCatIsInTheGardenWithItsPawInTheAir »
Longer = more secure?
Not necessarily, if the phrase is predictable: « MyPassword123 » remains easy to guess. It is important to create unique and unlikely phrases.What about OTPs then?
One-time passwords (OTP), particularly via SMS, are often presented as a secure alternative. They are popular because they offer an extra layer of protection if the primary password is compromised. However, the mobile network is not infallible, and techniques such as SIM swapping allow this protection to be bypassed.Changing your password regularly
A good practice consists of renewing passwords periodically to reduce risks related to prolonged compromise.A quick word for my dev friends
Rethinking complexity
Stop forcing arbitrary rules on special characters and focus on the overall quality of the password: its length, uniqueness, and how difficult it is to guess.Integrating change reminders
Implement systems that remind users to change their passwords regularly, while encouraging them to use password managers.For a more secure web
We must collectively move towards security practices that are both effective and accessible. For example, a password management system integrated into a browser or a mobile application would allow users to easily create long and unique passwords, while storing them securely.- As users, let's make the effort to adapt our passwords to these new principles.
- As developers, let's integrate systems that meet real security needs without unnecessarily complicating users' lives.
