Optimal password minimum length requirement? (In particular, does a 15 character minimum make sense for most university users?)

Question

Is there any professional consensus on what the optimal password minimum length requirement should be?

The University of Michigan recently implemented a 15 character minimum for all users.

To me (complete layperson), this seems foolish because this is difficult to remember and so now even more will record their passwords somewhere (e.g. on paper/a Google doc/word doc/text document) that can be easily stolen/hacked.

Also, there'll be many more "Forgot password" requests (and so more opportunities for being hacked).

Microsoft:

Best practices

In most environments, an eight-character password is recommended because it's long enough to provide adequate security and still short enough for users to easily remember.

Answer 1

Summary: the university of Michigan password creation policy seems fine, if not optimal

Explanation: NIST Special Publication 800-63 (currently version "-3") (titled "Digital Identity Guidelines") is the go-to guideline for password security. Among others, they recommend the following:

• enforce a minimum password length of 8 characters ("5.1.1.1 Memorized Secret Authenticators"⁽¹⁾)
• allow password lengths of at least 64 characters ("5.1.1.2 Memorized Secret Verifiers"⁽²⁾)
• don't expire passwords, unless there's an account compromise ("5.1.1.2 Memorized Secret Verifiers"⁽³⁾)
• passwords should be simple, not complex ("5.1.1.2 Memorized Secret Verifiers"⁽⁴⁾)

However, if you combine points 1 and 4 from above, then you may end up with simple, easy to guess passwords. Thus, it is advocated⁽⁵⁾ that it's better to use passphrases rather than passwords, which can be safer even if they are simple in structure (e.g. all lowercase characters).

Is there any professional consensus on what the optimal password minimum length requirement should be?

If you take a look at the password cracking table from Hive, that shows how much time it takes to brute-force a password that complies with specific complexity rules, you'll see that an 8-character-password with complex character combination is easily brute-forced in 5 minutes. Going from there, you either need an 12-character password with complex creation rules or 15 characters with only lowercase characters (numbers-only-passwords are inherently unsafe).

Given that the university of Michigan permits lowercase-only character passwords, a length of 15 characters for passwords seems optimal.

Edit (based on your comments here and here): Security controls are not selected at random and policies are not set "just because". They are based on research and lessons learned. In the case of optimum password length, please read above and follow the provided links.

As a summary, long password lengths are not set in order to counter attempts using the login process of the system. If that would the case, passwords would be much, much shorter. For example, if your system locks accounts after 5 failed attempts, then with a 4-character-long password, that consists of numbers and lowercase characters only, you get 36^4⁽⁶⁾ = 1.679.616⁽⁷⁾ possible combinations. This number is high enough to accept the risk of 5 login attempts from an attacker (less than 0,0003%⁽⁸⁾ probability of success). In other words, this attack vector (login attempts) is assessed and the security control in place (limit attempts to 5) is said to mitigate the risk.

However, a threat model that includes someone stealing the password db, needs to also account for password spraying or credential stuffing attacks to other systems. This is done in order to counter for lateral movements of attackers in the same network or denying them access to other networks (because humans tend to use the same password on different systems). In other words, we need to limit the blast radius of a stolen password. In order to do this, we need to make it difficult for an attacker to find out what the password is; if you used a 4 character password, any attacker, with trivial resources, would be able to brute force it in under a second. That is why you need to use longer passwords and this is where the minimum password lengths, relevant research, alternative authentication ways and the official guidelines come in.

You need to understand that information security is not a single-dimensional discipline.

---

¹ "Memorized secrets SHALL be at least 8 characters in length if chosen by the subscriber"

² "Verifiers SHOULD permit subscriber-chosen memorized secrets at least 64 characters in length"

³ "Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator"

⁴ "Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets"

⁵ "Use easy-to-remember passphrases rather than passwords, that have a minimum of 14 characters"

⁶ 26 characters (a-z) and 10 numbers (0-9)

⁷ the dot is used as a separator of thousands

⁸ comma is used as a decimal point

Answer 2

The motivation for the University of Michigan seems to be to encourage the use of passphrase / diceware. See Guidelines for a Secure Password, where 3 of the 4 tips are related to that.

In practice, I'd assume that most university users do need to remember their passwords and can't rely on password managers (the 4th tip). Then a 15-char password becomes difficult to remember, a 15-char passphrase is reasonable.

There has been a study that shows that users don't remember passphrases better than passwords with the same entropy. But passphrases with the same entropy will be longer, reaching the 15 char minimum quicker.

As for usability vs security regarding password complexity, there are numerous opinions:

• 8 characters is too short for offline bruteforce attacks (they recommend 16 chars).
• another opinion that 8 chars is too short (they recommend at least 12 chars).
• NIST recommends at least 8 characters, though the exact minimum is dependent on the thread model. They also recommend against complexity requirements (special character, etc).

Especially with the recommendation not to use complexity requirements (because they don't increase security by a lot, but do reduce usability significantly), an 8-char password may be bruteforced fairly quickly, even remotely (think password and 12345678). Requiring a 15-char password will help here. With guidance towards passphrases, usability isn't impacted by the length.

Answer 3

The 15 character passphrase is something I have seen other large organizations start to implement as well. I'm not sure where the number 15 came from but it seems to be a defacto standard of sorts.

The problem you had with the more traditional password system where it needed to be changed every 30 or 60 or 90 etc days is that it created the incrementing password. I have worked in many organizations which had the rolling passwords with the rule usually being it had to include 1x uppercase, 1x number and 1x special. So you wound up with everyone having a very similar password pattern:

[Special][Capital][Lowercase][2xNumber] eg %Password01

They would then just increment the number on the end. So for a brute force attack you are no longer working against an 8 character password with 96^8 possibilities. In the case of dictionary attacks it allows an attacker to create rules to modify their wordlist to fit the pattern.

The thinking now appears to be longer is better because wordlists usually target a single word or 2/3 short words concatenated. Having it be 15 characters minimum also makes it incredibly time consuming to brute force. The problem with the passphrase model is that the account holder will construct a sentence to help them remember the passphrase. Take into account human laziness and that sentence will be somewhere between 15 (because that is the minimum) and perhaps 20 characters long. Ultimately if I'm told it has to be 15 characters and I'm working in an environment where I have to type the thing in 30 times a day I'm not going to pick something 40 characters long.

The sentence structure is inherently the weakness of the passphrase. There are already wordlists floating around for passphrases. And some even come with rules for programs like Hashcat which allow for various permutations (for example if the user has spaces between the words or just concatenates them into a single word). I myself have been playing around with ChatGPT and building a passphrase list using based on the statistical probability of the next word in a sentence.

Ultimately the weakness of any sort of verification system is the end user. People are lazy and/or stupid. Whatever system you put in place the end user will come up with the simplest way to comply with it and not have to do anything more.

Answer 4

I would say an 8 character minimum is definitely too short these days, because that can be hacked in seconds unless there is a limit on the frequency of attempts. See for example https://www.grc.com/haystack.htm

When are attempts not limited? Most commonly when someone has got hold of the "hash" of your password. There have been many huge breaches where billions of hashed passwords have been exposed. (Admittedly "salting" can ameliorate that risk a bit, but you can't rely on that.)

In that context, 15 characters is a reasonable minimum. You can reduce it a couple of characters by requiring mixed case and special characters, but that brings its own set of problems and is a sticking plaster at best.

The problem of course is that it's hard to remember a 15 character password, and even if you could, they are difficult to type accurately. In a way that's good though, because it encourages people to completely avoid memorable passwords and use a password manager instead, or better still passwordless solutions like Windows Hello, phone apps or hardware keys.

Personally, I don't have any memorable passwords at all now, only memorable PINs as a second factor. Passwords seemed like a good idea when they were first invented, but we now know they're hideously insecure and we're trying to stuff that genie back in the bottle.

Answer 5

Is there any professional consensus on what the optimal password minimum length requirement should be?

There are two common opinions about this:

• eight characters minimum
• longer is better

NIST says minimum of 8 characters in a password. Microsoft says minimum of 8, and longer is not necessarily better. OWASP Cheatsheet says minimum of 8. OWASP ASVS says 8 in the most recent version.

All things equal, longer passwords are stronger than shorter passwords. However, doubling the minimum length of passwords does not necessarily result in double the security. People will just pad their password or type it twice to comply to the length minimum, instead of coming up with a stronger password. Thinking about the entropy of a password without considering user psychology is a common pitfall.

In particular, does a 15 character minimum make sense for most university users?

Even though not everyone agrees on whether the 8 character limit is sufficient, there is little reasoning about any other limit. What is the reasoning behind this 15 character minimum? Why not 14 or 16? If this was the result of a research project, it may make sense. If someone just picked a nice number, it may not.

Without any further information, I am not sure that a 15 character minimum is necessarily more secure than a 8 character minimum.