The Wide Diversity of Password Requirements – And how to cope with it
summary
An automated crawler extracts password rules from live sites and produces a uniform PRD database for 185,696 services; only ~57,000 (≈30%) publish any requirements and ~4,000 publish complete specs, yielding 1,400+ distinct rule sets. Analysis finds ~60% of sites enforce no meaningful brute‑force resistance and attack‑resistant (≥128‑bit) passwords work on only ~78% of sites. An optimal fallback uses 22 characters (letters+digits) to reach ~128‑bit strength with ~76.6% acceptance. A KeePass plugin and web app generate compliant passwords.
AI-written summary · about
chapters (7)
- 0:00Start
- 0:54comply with the individual password requirements of the services
- 6:26extracts password requirements from the text
- 12:08specify a minimum password length
- 12:48take a look at the maximum password length
- 14:28store the size of your passwords
- 17:17developed a uniform description for password requirements
related talks
10mPassword policies of most top websites fail to follow best practices
23mFantastic Passwords and Where to Find Them
40mFantastic Passwords and Where to Find Them
47mYour Password Complexity Requirements are Worthless
25mEverything You Know About Passwords Is Wrong
10mImproving Password Generation Through the Design of a Password Composition Policy...
05mPlease do not use !?_ or your License Plate Number: Analyzing Password Policies in
24mUsability vs. Security. Can they live together?