Microsoft upends traditional password recommendations with significant new guidance

Based on research gleaned from literally billions of login attempts to its Azure cloud service, Microsoft updates its password recommendations – and throws out several long-held industry best practices.

Microsoft has recently published a white paper, “Microsoft Password Guidance” that explains their new password guidance, based on the massive amount of data they’re collecting at Azure AD login. (They see more than 10 million username / password attacks every day.) Some of it is what you might think…but some of it defies conventional password wisdom.

The author (Robyn Hicock on the Microsoft Identity Protection Team with a long list of contributors from her fellow team members, Microsoft Research, and Microsoft IT) states that long-held password practices fall down in the face of modern credentials-oriented attacks. Further, some of these policies actually increase the ease with which passwords can be compromised and should thus be changed or abandoned all together.

Microsoft recommends seven actions to provide maximum password-based identity protection:

Maintain an 8-character minimum length requirement (and longer is not necessarily better).
Eliminate character-composition requirements.
Eliminate mandatory periodic password resets for user accounts.
Ban common passwords, to keep the most vulnerable passwords out of your system.
Educate your users not to re-use their password for non-work-related purposes.
Enforce registration for multi-factor authentication.
Enable risk based multi-factor authentication challenges.
Let’s look at the more unusual recommendations that directly affect how an organization would set their domain password policy.

Kill Anti-Patterns
Maintain an 8-character minimum length requirement. Microsoft Research has found that long, complex web passwords are a burden to users (no surprise there) but are actually of limited effectiveness for several reasons. The strength of the password is irrelevant if the user is caught in a phishing attack and provides it, or has keylogger malware on their system. These are the most common attacks according to the authors. The password only needs to be strong enough to withstand a “three strikes” type lockout rule. Note that though this study is about web passwords, there’s no reason it shouldn’t also apply to Active Directory passwords (and your own lockout policy).

Eliminate character-composition requirements. This is a nice idea in the abstract, but Microsoft and others (Bruce Schneier, for example) have found that, when confronted with password complexity requirements, people fall into a few recognizable patterns that password cracking programs exploit. For example, it turns out that a typical password consists of a root that’s usually something pronounceable plus a suffix such as a number. And yes, they know that you’re using “$” for “s”, “!” for “i”, etc!

Eliminate mandatory periodic password resets for user accounts. Periodic password changes, again a nice idea in principle, fail when run through the human brain. Why? Because people tend to make their new password based on their old one, in a very predictable manner. In addition, since criminals use passwords as soon as they compromise them there’s no benefit in containment (i.e. “We’ve been compromised; please change your password to prevent your account from being hacked” warnings are far too late).

Also find : microsoft password support