The growing number of online accounts has made managing passwords increasingly difficult. With users juggling dozens of accounts, creating secure yet memorable passwords has become a major challenge.
Traditional password guidelines emphasize complexity, requiring combinations of uppercase and lowercase letters, numbers, and special characters. While intended to enhance security, these rules often lead to predictable, unsafe practices:
Recent research indicates that the emphasis on complexity may be counterproductive. The US National Institute of Standards and Technology (NIST) has revised its password management guidelines, prioritizing password length over complexity. Key changes include:
Longer passwords, even without special characters, are significantly harder to crack and easier to remember. This shift marks a departure from the belief that complexity alone ensures safety.
Overly complex passwords often lead users to adopt risky behaviours, such as:
These habits compromise security, leaving accounts vulnerable to brute-force attacks or credential theft. Reports such as the 2021 Verizon Breach Investigations indicate that 80% of hacking-related breaches stem from stolen or brute-forced credentials.
Managing an average of 85 passwords presents a significant burden for individuals and organizations. Enterprises, for instance, spend substantial resources—around $495,000 annually for every 1,000 employees—resolving access-related issues. Despite the availability of password managers, gaps in security remain.
As "security fatigue" grows, passwordless authentication methods are gaining traction. Technologies such as biometrics and adaptive single sign-on (SSO) offer enhanced security and convenience. By leveraging machine learning, these solutions adjust access controls dynamically, reducing login friction and improving the user experience.
Length plays a decisive role in password security. Advanced computing power has diminished the effectiveness of short, complex passwords, while longer ones remain resilient against brute-force attacks. For example, Eric Adams, Mayor of New York City, increased his smartphone passcode from four to six digits, dramatically raising the number of possible combinations.
NIST now recommends passwords up to 64 characters in length. Even a password composed solely of lowercase letters becomes exponentially harder to crack when its length increases. Adding uppercase letters and symbols makes it virtually impenetrable.
In today’s cybersecurity landscape, balancing usability and security is essential. Experts recommend:
By adopting practical measures, users can minimize risky behaviours and enhance digital security. As cyber threats evolve, prioritizing password length and implementing user-friendly solutions are key to safeguarding online accounts.
The new program was proposed by the Federal Communications Commission Chairwoman Chairperson Jessica Rosenworcel. The program apparently aims at helping consumers make well-informed decisions over purchasing products, like identifying the marketplace with advance cybersecurity standards.
"The goal of the program is to provide tools for consumers to make informed decisions about the relative security of products they choose to bring into their homes," the administration said.
Under the proposed programs, consumers are likely to see a newly formed “U.S. Cyber Trust Mark” label, that will serve as a shield logo, distinguishing the products that satisfies the established cybersecurity criteria. Apparently, these criteria will be decided by the National Institute of Standards and Technology (NIST), which will include criteria like unique and strong default passwords, data protection, software updates and incident detection capabilities.
According to the administration, a number of significant retailers, trade groups, and manufacturers of consumer goods such electronics, appliances, and consumer goods have made voluntarily commitments to improve cybersecurity for the products they sell. Amazon, Best Buy, Google, LG Electronics USA, Logitech, and Samsung Electronics are among the participants.
Plans for the program was prior discussed by the Biden administration in late 2022 to establish a voluntary initiative with internet of things makers to help ensure products meet minimum security standards.
Reportedly, the FCC, which is responsible for regulating wireless communication devices is set to seek public comment regarding the labeling program by 2024.
According to the administration, the FCC is applying for registration to the U.S. Patent and Trademark Office to register a national trademark that would be used on products that satisfy the predetermined standards.
"The proposal seeks input on issues including the scope of devices for sale in the U.S. that should be eligible for inclusion in the labeling program, who should oversee and manage the program, how to develop the security standards that could apply to different types of devices, how to demonstrate compliance with those security standards, how to safeguard the cybersecurity label against unauthorized use, and how to educate consumers about the program," the FCC notice says.
The proposal highlights inclusion of a QR code to products that will provide consumers with information, pending a certification mark approval by the U.S. Patent and Trademark Office.
Common vulnerabilities and exposures, or CVEs, are seemingly increasing at a faster rate as a proportion of the overall number of bugs reported, which, according to a survey, have increasingly risen as per the cybersecurity teams. These are very easy to exploit.