The man responsible for most of your password headaches was wrong, and he's sorry

In 2003, Bill Burr, a manager at the U.S. National Institute of Standards and Technology, wrote an 8-page paper titled "NIST Special Publication 800-63. Appendix A." That document — which suggested people come up with obscure passwords with capital and lower-case letters plus symbols and change their passwords often — became the cornerstone of corporate password management and internet security conventional wisdom for more than a decade. Now, Burr, 72 and retired, has a confession and an apology, The Wall Street Journal reports. "Much of what I did I now regret," he said.

When he wrote those guidelines, Burr tried to find empirical data to base his recommendations on, but there wasn't any available; he also says he was under pressure to complete his paper quickly. But thanks to years of massive hacks and leaked passwords, researchers can see what kind of passwords people are using, and it turns out, people aren't as clever or original as they think. "Changing Pa55word!1 to Pa55word!2 doesn't keep the hackers at bay," notes the Journal's Robert McMillan.

In June, NIST published a revised version of Burr's document, with much of his advice excised. After expecting to do a light edit, "we ended up starting from scratch," says Paul Grassi, who led the two-year review and rewrite. Now, the best practice is to come up with a long and easy-to-remember password and change it only if there's evidence of a security breach. In a widely shared cartoon, Randall Munroe accurately estimated that a Burr-type password like "Tr0ub4dor&3" could be cracked in three days, while four common words jammed together — "correcthorsebatterystaple" — would take 550 years to crack. You can go change your passwords now, and read more at The Wall Street Journal.

Subscribe to The Week

Escape your echo chamber. Get the facts behind the news, plus analysis from multiple perspectives.

SUBSCRIBE & SAVE

Sign up for The Week's Free Newsletters

From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.

From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.

Sign up