In a recent PBS Newshour article discussing the recent Yahoo! password list theft, a reference to a chart showing howshort passwords can still be secure was added to the story. The data and conclusions included in that chart were disturbing to me, to say the least.  While complexity does add to the number of characters one would have to try to brute force attack a password lengthening the password has a much greater effect on improving password security particularly when you force people to use the complexity.

Actually requiring combinations of letters, numbers, and symbols in a short password increases the chances of the password being cracked as you have limited the theoretical set of combinations that could be used to make the password, thus making rainbow tables much more efficient. In the paper*Reduced Keyspace with Password Complexity* the math clearly shows how this actually occurs.

`The Usability of Passwords <http://www.baekdal.com/insights/password-security-usability>`__ study, by Thomas Baekdal, also includes quite a few assumptions that aren't very realistic. Saying that “...most web applications would not be capable of handling more than 100 sign-in requests per second” is a rather big assumption of unknown systems where these attacks might occur. A quick Google search returns a wide range of answers including one discussing the limiting factor of one system being the iSCSI storage system and the system only being able to handle 200 sign-in requests per second, per server. With cloud computing you could potentially have hundreds or thousands of servers bring brought together to handle whatever the load.

Another assumption is that the passwords are being attacked remotely and are actually removed from the system, like what happened with LinkedIn and Yahoo!. Once an encrypted list of passwords are brought locally the attack could occur quite quickly and the latency of the home system's interface and the network are removed completely. Mr. Baekdal is correct, however, when discussing passwords that are not stored encrypted. Complexity and length will not help you there. What will help you, though, is the use of a unique password for each account you have so that if the password is exposed you haven't put all your accounts at risk.

Oddly enough, it appears that Mr. Baekdal has already been confronted with these issues but still doesn't get it. Again, his assumptions get in the way of what the possibilities truly are. He is correct in saying that people generally can't remember long, complex passwords. But the use of technology helps us. Using a password safe to store your randomly-generated, long passwords for each site you visit makes life a lot easier and more secure. There are several to choose from and many that you may already have on your system like the one that Mozilla includes in its Internet browser Firefox.

I'm quite appalled that the reparable news source Newsline would provide such bad advice to their readers. For the non-technical people that read that article, and that don't understand the bad assumptions provided, the possibility that they will become more confused about how to properly protect themselves when they hear advice that is backed up by mathematics is great. It's time we stop with all the bad advice and come together with a clear and concise message that is backed up by the math. It's not difficult to protect yourself online and while you do have to put some trust in the remote system you can still mitigate many of those risks yourself.