The Rewards and Costs of Stronger Passwords in a University: Linking Password Lifetime to Strength
summary
University password policy links Shannon entropy to lifetime so 50 bits = 100 days up to 120 bits = 350 days. Study uses an institution of ~100,000 accounts with 200,000 changes and 115,000 resets over 14–16 months. Average lifetime rises from 146 to 170 days (≈63 to 70 bits) after ~100 days of uptake. Passwords rated >300 days are about four times likelier to be reset, and users with multiple resets pick lifetimes ≈10 days shorter.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 0:46New University Password Policy
- 1:13Strength of the Password
- 1:48The Password
- 2:41Lock Data
- 9:05Average Password Strength
- 10:54Average Password Change
- 11:09Password Expiration
- 12:44User Demographics
- 14:44User Perceptions
- 15:32Findings
- 17:17Conclusion
- 20:24Questions
related talks
25mEverything You Know About Passwords Is Wrong
01h 05mPasswords are not going away
31mBreaking Bad (Passwords)
12mThe more accounts I use, the less I have to think': A Longitudinal Study on the...
23mFantastic Passwords and Where to Find Them
23mImplementing "password never expires"
47mYour Password Complexity Requirements are Worthless
11mEvolution of Password Expiry in Companies: Measuring the Adoption of Recommendations...