“Passwords are an essential part of modern life. Every day we provide passwords as authentication to systems and services, both in the workplace and at home. A recent survey reported that UK citizens each had an average of 22 online passwords, far more than most people can easily remember. Password guidance-including previous CESG guidance – has encoura ged system owners to adopt the approach that complex passwords are ‘stronger’. The abundance of sites and services that require passwords means users have to follow an impossible set of password rules in order to ‘stay secure’. Worse still, the rules-even if followed- don’t necessarily make your system more secure. C omplex passwords do not usually frustrate attackers, yet they make daily life much harder for users. They create cost, cause delay s, and may force users to adopt workarounds or non-secure alternatives that increase risk…”