SAN FRANCISCO — Users of a widely deployed account system reported this week that new password requirements include one uppercase letter, one number, one symbol and one formative childhood experience.
The additional field appears after submission, alongside a message indicating that the previous password was not accepted.
“Complexity is the foundation of security,” a security consultant said.
Under the updated rules, passwords may not resemble any previous password, any dictionary word, or anything the user is capable of remembering.
“It also cannot contain your name,” the consultant said. “Or the name of anyone who has disappointed you.”
Users are advised to store the password in a manager, which requires its own password.
The system will require a reset in ninety days.
Analysts expect requirements to expand next year to include a second symbol and a brief written statement.
Most users will select the same password with a 2 at the end.
