Chapter III
The rules
Capitals, numbers, symbols, a change every 90 days, and what people did to keep their passwords their own.
Who decided passwords need a capital, a number, and a symbol?
A government guideline and the credit-card industry, but the guideline’s co-author later regretted it.
The long answerWhy did we have to change our passwords every 90 days?
Because it seemed more secure, until research showed it wasn’t: people had just been nudging the old one.
The long answerWhy can a security question be weaker than a password?
Because the answer is often one search away.
The long answerHow did a web comic change password advice?
By showing that four random words beat one clever, mangled word.
The long answer