Password policy: protections and precautions

Most people were never formally taught how to create a secure password. It was just something you did when a form asked for one. That informality has not aged well. Brute force attacks are increasingly automated and sophisticated, computing power has made short or predictable passwords trivially breakable, and the market for stolen credentials is substantial. In a research environment, where sensitive health data is involved, the consequences of a breach extend well beyond the team, potentially touching every participant whose data sits behind that credential.

Password policy often gets treated as an IT department concern rather than a research integrity one. That framing undersells it. A compromised account with access to a study database is a data breach, an audit finding, and a participant trust problem rolled into one, and the entry point is very often something as mundane as a weak or reused password rather than a sophisticated attack.

The most common problems

Memorable passwords are guessable passwords. Names of family members, pets, or favourite sports teams are easy to remember precisely because they are personally meaningful. They are also exactly what automated attacks are designed to try. Public social media profiles often make the guesswork even easier.

Reused passwords multiply your risk. If you use the same password across multiple platforms and one of those platforms is breached, all of your accounts using that password are now at risk. You have no way to verify the security practices of every service you sign up to.

Passwords shared insecurely can be intercepted. Email, text messages, and messaging apps are not secure channels for transmitting credentials. Neither is a sticky note near a workstation. Both are still surprisingly common.

Browser-saved passwords carry their own risks. It is not always clear how browsers encrypt stored passwords or where they are held. Browser extensions and plugins may have access to stored credentials.

Two-factor authentication is often avoided. It adds a step, so people skip it. But a one-time code sent to a verified device or generated by an authenticator app is one of the most effective barriers against unauthorised access, even when a password has been compromised.

How quickly passwords actually fail

Short or simple passwords are not just weak: against modern hardware, they offer very little real protection. The widely referenced Hive Systems Password Table, which models crack times using current consumer GPU hardware, puts real numbers on this:

That "assuming" in the third row matters more than it might seem. These estimates depend heavily on how the receiving system actually stores the password. A well-designed system using a deliberately slow hashing algorithm turns even a fairly short complex password into a genuinely difficult target. A poorly designed system using fast, unsalted hashing can make the same password trivial to recover if the database is ever breached, which is entirely outside your control as an individual user. The practical takeaway is that length is the one lever you always control regardless of how well any given service has implemented its own security, which is exactly why NIST's current password guidance has moved toward recommending a 15-character minimum rather than relying on complexity rules alone.

What actually helps

• Use a reputable password manager (such as Bitwarden) to generate and store unique passwords for every account
• Never reuse a password across platforms, regardless of how strong it is
• Use long, randomly generated passwords rather than predictable substitutions (swapping "e" for "3" or "s" for "$" is a well-known pattern that attackers already account for)
• Enable two-factor authentication wherever it is available
• Never share passwords via email, text, or messaging apps
• Treat the master password for your password manager as your most important credential
• Favour length over cleverness: a long, randomly generated passphrase is both easier to remember and harder to crack than a short, symbol-heavy substitution

In a clinical research context, where data security is both an ethical obligation and a regulatory requirement, these practices are not optional. They are the baseline, and the gap between "baseline" and "what most people actually do" is precisely where most credential-related breaches originate.