The article is for subscribers only, which I'm not (and won't be).

Not if you're using a VPN and open it from a different location. From Mexico, for instance.

 

Not if you're using a VPN and open it from a different location. From Mexico, for instance.

I figure that if they want to restrict access to their content, then they have the right to do that and I will abide by their choice. I figure that's only fair since, if I were to decide to restrict who I want to have access to content I post on my website, I would like others to respect that choice as well (even knowing that many people won't). Basically, they've decided that they don't need my business, and that's true and I respect that. But I can decide that I need to do business with them even less.

 

It's even more complicated than that, because the answer depends on subtle details usually omitted from the question.

The question might be, "What can we do to increase account security?" But what is meant by "account security"? Is it individual or collective? Implementing the "no repeated digits" rule might decrease the collective rate of compromised accounts, but at the same time increase the likelihood that an individual that is taking proper precautions gets compromised. Essentially what is being done is to improve the security of the lazy people by reducing the security of the diligent people. Is that the tradeoff we want? Maybe. But it's something that should be considered but that seldom is.

Also, I say that the new rule "might" help protect the lazy people, but it might not. The person that was so lazy that they used 1234 is still a lazy person and, collectively, the lazy people will gravitate toward a new set of patterns that the bad guys will figure out and create a new dictionary for the new rules.

Back when password complexity rules were increasing all the time, I used to joke that eventually the rules would be so strict that the bad guys would only need to memorize the twelve remaining legal passwords.

Yes that's what I was thinking too, but unfortunately, I don't have the full set of rules on hand I only know the few I quoted.

 

Yes that's what I was thinking too, but unfortunately, I don't have the full set of rules on hand I only know the few I quoted.

The rules were determined by organizational policy, so while there were some pretty common ones, they also varied a lot from one organization to another. Some of the more common ones were:
Minimum length 8 characters
At least one upper case letter
At least one lower case letter
At least one digit
At least one special character (often without telling you which special characters were allowed and which weren't).

Many, many sites used the above set of rules.

Other common rules might be:
Can't use one of the last N passwords (where N might be anything from 1 to 12).
Can't have your username, account number, or social security number as part of the password (sometimes it was any part longer than N characters).
Had to change the password every N days, where N might be anything from a month or two up to a year or so.

Rules against repeated characters in a password were pretty uncommon, but against them in a PIN were very common.

Current NIST guidelines specifically recommend against having complexity requirements (beyond minimum length) or frequent expiration. While the standard recommends 8 characters as an absolute minimum, it recommends 12-15 as a better floor and 16 if feasible. It also recommends allowing passwords to be at least 64 characters long and to include the entire printable ASCII character set as allowed symbols. Users are recommended to use a phrase that they can easily remember without writing down, unless they use a password manager. They also recommend sites NOT use features that hinder the use of password managers, such as preventing autofill or not allowing pasted passwords. Another big recommendation was for systems to vet user passwords against the databases of known compromised passwords, which prevents users from using 'password' or even 'Pa$$w0rd1!".

 

This is why I was also a copier technician along with crypto, etc.... We fixed all TS rated gear back then, no contractors.

https://www.techradar.com/pro/today...n-to-steal-the-film-right-in-front-of-the-kgb

https://forum.allaboutcircuits.com/threads/why-paper-jams.145454/

 

The rules were determined by organizational policy, so while there were some pretty common ones, they also varied a lot from one organization to another. Some of the more common ones were:
Minimum length 8 characters
At least one upper case letter
At least one lower case letter
At least one digit
At least one special character (often without telling you which special characters were allowed and which weren't).

Many, many sites used the above set of rules.

Other common rules might be:
Can't use one of the last N passwords (where N might be anything from 1 to 12).
Can't have your username, account number, or social security number as part of the password (sometimes it was any part longer than N characters).
Had to change the password every N days, where N might be anything from a month or two up to a year or so.

Rules against repeated characters in a password were pretty uncommon, but against them in a PIN were very common.

Current NIST guidelines specifically recommend against having complexity requirements (beyond minimum length) or frequent expiration. While the standard recommends 8 characters as an absolute minimum, it recommends 12-15 as a better floor and 16 if feasible. It also recommends allowing passwords to be at least 64 characters long and to include the entire printable ASCII character set as allowed symbols. Users are recommended to use a phrase that they can easily remember without writing down, unless they use a password manager. They also recommend sites NOT use features that hinder the use of password managers, such as preventing autofill or not allowing pasted passwords. Another big recommendation was for systems to vet user passwords against the databases of known compromised passwords, which prevents users from using 'password' or even 'Pa$$w0rd1!".

Oh that's interesting about NIST. But I do have to agree with the reasoning that the very simple ones are too easy to guess and that too many users resort to those simple ones. So it's not just math, it's also about human nature. If half of the users are using passwords like 2233 then there is a more likely chance of the attacker gaining access because that's the ones they usually try first. The entire ranges of pins does not decrease too much
if there are limits on the banned types. The real issue is that most of the ones that have ALREADY been compromised actually did use pins like 2233 or something easy like that, so that is why I believe they started to implement these bans. I would wonder if NIST takes human behavior into account as well as the probability math itself.

 

Oh that's interesting about NIST. But I do have to agree with the reasoning that the very simple ones are too easy to guess and that too many users resort to those simple ones. So it's not just math, it's also about human nature. If half of the users are using passwords like 2233 then there is a more likely chance of the attacker gaining access because that's the ones they usually try first. The entire ranges of pins does not decrease too much
if there are limits on the banned types. The real issue is that most of the ones that have ALREADY been compromised actually did use pins like 2233 or something easy like that, so that is why I believe they started to implement these bans. I would wonder if NIST takes human behavior into account as well as the probability math itself.

The shift in NIST guidelines is driven entirely by human factors considerations.

 

The shift in NIST guidelines is driven entirely by human factors considerations.

Hi,

It didn't sound like it to me, but ok, I'll see if the changes being made actually improves anything or not.
It would be funny if on average MORE accounts got hacked AFTER the changes (ha ha).

I am not sure I understood you correctly though, did you say that NIST does not recommend the banning of pins like 2222 or 3377 and the like ?

 

The shift in NIST guidelines is driven entirely by human factors considerations.

It didn't sound like it to me, but ok, I'll see if the changes being made actually improves anything or not.
It would be funny if on average MORE accounts got hacked AFTER the changes (ha ha).

I am not sure I understood you correctly though, did you say that NIST does not recommend the banning of pins like 2222 or 3377 and the like ?

What are the problems with the previous common guidelines of having to have at least one each of four different types of symbols and having to frequently change passwords?

Human factors.

People tend to use the shortest passwords allowed, use simple patterns, such as qwQW12!@, make simple modifications when required to change it, such as appending a serial digit, write their passwords down near their computer, and use the same password for multiple sites. The bad guys know that this is how lots of people will respond given onerous password rules, so they've built up huge dictionaries of likely passwords under these conditions. When they do have a success and get the password for one account for a particular user, they then have a much higher likelihood of being able to compromise more of their accounts.

But if people are allowed to use any longer phrase, which is why NIST recommends a minimum of 16 characters and recommends that passwords of up to 64 characters be allowed as well as all printable ASCII characters, then they are much more likely to use a phrase or word sequence that is memorable to them without ever writing it down, especially since they know they won't ever have to change it. As an example, the account with my retirement funds has used these guidelines since before I opened my account with them over twenty years ago. My password there has been the same since day one, yet has never been written down or used elsewhere. It's not even entered in my password manager, so even if someone were to successfully hack that, they wouldn't get any closer to accessing that account. And notice that NIST has also addressed people that still use simple pattern passwords by recommending that passwords be vetted against databases of compromised passwords (i.e., use the same dictionary that the bad guys use).

 

https://www.nbcnews.com/tech/securi...now-about-passwords-says-man-who-made-n790711

Was it m@nk3yP@$$w01rd or m0nk3yp@ssw0!rd?


**#@$%!!


For 20 years, the standard advice for creating a "strong" password that is hard to crack has been to use a mix of letters, numbers and symbols.

It's so ingrained that when you go to create a new email account you'll frequently get praising or finger-wagging feedback from the computer on how well your secret code adheres to these guidelines.

And you're supposed to change it every 90 days.

Now, the man who laid down these widely followed rules says he got it all wrong.

“Much of what I did I now regret," Bill Burr, a 72-year-old retired former manager at the National Institute of Standards and Technology told the Wall Street Journal.

 

https://www.theguardian.com/technology/2026/aug/03/apple-legal-challenge-uk-government-data-access

Apple launches legal challenge against UK government demand to access data
The Home Office has made a fresh request for ‘back door’ access to encrypted iCloud data belonging to British users

 

https://www.theguardian.com/technology/2026/aug/03/apple-legal-challenge-uk-government-data-access

Apple launches legal challenge against UK government demand to access data
The Home Office has made a fresh request for ‘back door’ access to encrypted iCloud data belonging to British users

This can include forcing companies to provide the UK security services with access to customer data, even if such information is protected by secure encryption.

If ANYONE other than the owner of the data can access it, then it is not secure.

The Home Office has maintained that the Investigatory Powers Act, under which such orders are issued, contains robust safeguards and is used only when absolutely necessary.

Gee, where have we heard those promises before? How often have they turned out to be hollow?

 

https://www.courtlistener.com/docket/69660910/41/united-states-v-sealed/

 

What are the problems with the previous common guidelines of having to have at least one each of four different types of symbols and having to frequently change passwords?

Human factors.

People tend to use the shortest passwords allowed, use simple patterns, such as qwQW12!@, make simple modifications when required to change it, such as appending a serial digit, write their passwords down near their computer, and use the same password for multiple sites. The bad guys know that this is how lots of people will respond given onerous password rules, so they've built up huge dictionaries of likely passwords under these conditions. When they do have a success and get the password for one account for a particular user, they then have a much higher likelihood of being able to compromise more of their accounts.

But if people are allowed to use any longer phrase, which is why NIST recommends a minimum of 16 characters and recommends that passwords of up to 64 characters be allowed as well as all printable ASCII characters, then they are much more likely to use a phrase or word sequence that is memorable to them without ever writing it down, especially since they know they won't ever have to change it. As an example, the account with my retirement funds has used these guidelines since before I opened my account with them over twenty years ago. My password there has been the same since day one, yet has never been written down or used elsewhere. It's not even entered in my password manager, so even if someone were to successfully hack that, they wouldn't get any closer to accessing that account. And notice that NIST has also addressed people that still use simple pattern passwords by recommending that passwords be vetted against databases of compromised passwords (i.e., use the same dictionary that the bad guys use).

Yes, and I will admit one time I used the pin "11111" because I was in such a hurry and didn't want to have to remember a new pin right away. It was a little more secure than usually though because nobody could access the account without using my actual equipment at home, so they would have to first break into the home and THEN guess the password. I intended to change it but never did. The account is no longer active though so I don't have to worry about it anymore anyway.

 

https://www.thedrive.com/news/flock...-people-at-risk-overhauls-police-search-rules
Flock Admits Failures That Put Innocent People at Risk, Overhauls Police Search Rules
Flock CEO Garrett Langley says wrongful stops show a failed system and is tightening search rules while cutting data retention.

The BBC reported, “He added that he has come to agree with groups like the American Civil Liberties Union and the Electronic Frontier Foundation that police should need an active case number to search Flock’s data.” and quoted Langley as following with “They’re right. I think it should be required.”

Money talks, they are losing contracts.

 

https://arstechnica.com/security/20...control-of-macs-is-under-active-exploitation/
Vulnerability giving attackers full control of Macs is under active exploitation
Screen-sharing bug lets remote hackers log in without a password.

 

https://arstechnica.com/security/20...control-of-macs-is-under-active-exploitation/
Vulnerability giving attackers full control of Macs is under active exploitation
Screen-sharing bug lets remote hackers log in without a password.

VNC on an exposed port?

Is Apple still working on the Y2K problem, too?