Passphrases: Understanding The Barriers To Adoption
As we near the end of 2024, it is still the case that most organisations across the UK use passwords (as opposed to passphrases) when logging in to digital services and applications.
While passphrases are easier to remember and arguably more secure, users are being held back by legacy password policies that do not allow passphrases or restrict the user in some way by requiring complexity (often inconsistent) such as only allowing certain special characters, excluding spaces or not allowing longer character input.
While we recognise that changing password policies can be difficult to scope and get consensus upon, to help make our argument easier, we refer you to the National Cyber Security Centre advice that recommends using ‘three random words‘ as their preferred password policy.
It is well-known that today’s users are expected to remember hundreds of passwords in their digital lives. A fundamental weakness of having to remember so many is that users end up making them either; easy to guess, re-used, re-constructed or just not complex enough to stop modern-day cyber criminals. Where passwords are properly applied using complexity rules, users often create additional security risk by resorting to writing them down somewhere for convenience.
What’s stopping organisations from using passphrases?
Let’s look at some of the contributing reasons why organisations may not be adopting the passphrase approach to data security.
There are basically three leading factors contributing to why passphrases aren’t as popular as traditional passwords:
1. Legacy systems: As stated above, many older systems, websites and apps may not support passphrase authentication or may require complexity password formats or have too low character limits. Even if there is an upgrade path allowing for passphrases, it might be seen as either too expensive or time-consuming to implement.
2. Lack of awareness: Organisations and individuals may not know that their systems can use passphrases, as well as passwords. With phishing scams and other cyber-crimes on the rise, it is more important than ever to empower your users with stronger password policies which they can easily remember.
3. User preferences: Although a rarity, some users find passwords easier to remember or prefer the convenience of typing them this way.
Download our free 3500 sanitised 5-letter word list.
As a business that provides data security and encryption services to our customers, we have created our own unique word file that we use as the basis for our passphrase generator.
The free file consists of over 3500 curated 5-letter words that will help you avoid embarrassing phrases, religious references, swear words and other inappropriate connotations. You can download it here for free.
This file is completely free for you to use & adapt to develop your own high-entropy passphrases. For example, when using any three words with spaces, one word including a capital letter and one word including a number, the password entropy becomes over 100.
To give you a few examples, we’ve seen some of our client’s users generate memorable, secure and fun passphrases including:
Chicken Tikka Masala is £8.95 – Entropy 190 Bits
Don’t forget Jane’s birthday on the 11th – Entropy 256 Bits
Passphrases: Understanding The Barriers To Adoption
As we near the end of 2024, it is still the case that most organisations across the UK use passwords (as opposed to passphrases) when logging in to digital services and applications.
While passphrases are easier to remember and arguably more secure, users are being held back by legacy password policies that do not allow passphrases or restrict the user in some way by requiring complexity (often inconsistent) such as only allowing certain special characters, excluding spaces or not allowing longer character input.
While we recognise that changing password policies can be difficult to scope and get consensus upon, to help make our argument easier, we refer you to the National Cyber Security Centre advice that recommends using ‘three random words‘ as their preferred password policy.
It is well-known that today’s users are expected to remember hundreds of passwords in their digital lives. A fundamental weakness of having to remember so many is that users end up making them either; easy to guess, re-used, re-constructed or just not complex enough to stop modern-day cyber criminals. Where passwords are properly applied using complexity rules, users often create additional security risk by resorting to writing them down somewhere for convenience.
For further reading, we’ve covered the pros and cons of using passphrases, which you can find in our Which is Better: Passphrase or Password? article.
What’s stopping organisations from using passphrases?
Let’s look at some of the contributing reasons why organisations may not be adopting the passphrase approach to data security.
There are basically three leading factors contributing to why passphrases aren’t as popular as traditional passwords:
1. Legacy systems:
As stated above, many older systems, websites and apps may not support passphrase authentication or may require complexity password formats or have too low character limits. Even if there is an upgrade path allowing for passphrases, it might be seen as either too expensive or time-consuming to implement.
2. Lack of awareness:
Organisations and individuals may not know that their systems can use passphrases, as well as passwords. With phishing scams and other cyber-crimes on the rise, it is more important than ever to empower your users with stronger password policies which they can easily remember.
3. User preferences:
Although a rarity, some users find passwords easier to remember or prefer the convenience of typing them this way.
Download our free 3500 sanitised 5-letter word list.
As a business that provides data security and encryption services to our customers, we have created our own unique word file that we use as the basis for our passphrase generator.
The free file consists of over 3500 curated 5-letter words that will help you avoid embarrassing phrases, religious references, swear words and other inappropriate connotations. You can download it here for free.
This file is completely free for you to use & adapt to develop your own high-entropy passphrases. For example, when using any three words with spaces, one word including a capital letter and one word including a number, the password entropy becomes over 100.
To give you a few examples, we’ve seen some of our client’s users generate memorable, secure and fun passphrases including:
< Back to news & blogs
Want to know more?
Call Us
01904 500255
Message Us