Researchers Recommend Three Random Word Passwords
The subject of password security and creating strong passwords predates even the Internet. The curious thing is, even though paradigms and guidelines change once in a while, the core subject is always topical. No matter if you are password-protecting your archive file on a floppy drive in 1991 or trying to come up with a password for your newest account to a paid online service or email, you always want to create a password that is strong and reliable.
We have covered the issue of password security and password complexity and strength multiple times on this website, but in light of recent publications by security researchers, it probably won't hurt to take a new, fresh look at the issue.
Security researchers working with the United Kingdom's National Cyber Security Centre, or NCSC for short, have once again re-confirmed the notion that it is a better idea to choose three words at random and string them together in a password than to try to come up with a semi-complex alphanumeric string of characters that could potentially lead to the creation of very weak passwords.
Part of the reason why the NCSC is advising a move to three-word passwords is chiefly because the global adoption of password managers remains "very low" as per the NCSC article. Additionally, human beings and human brains in general are much better at storing information in the form of a string of meaningful words than storing it in what might be a single long password string with a very complex structure.
The four chief reasons for the three-word recommendation are outlined by the NCSC as "length, impact, novelty and usability". Length is self-explanatory - you can essentially make a password un-guessable by sheer length and three randomly chosen words will give you a decent length of the full password string that will likely stump brute-force attempts.
Impact relates to the sheer simplicity of explaining to someone the concept of "three random words", so everyone can come up with a password such as "lemonade mousepad gerbil" and store it in their brain securely.
Novelty can be a bit arguable here, as this is not a completely new approach, but the reasoning is that a single-string password will often be a single word with some characters altered and those are notoriously easy to guess.
A good incentive to use three random words as your password is also the fact that hackers would often use algorithms that are more easily stumped by strings of random words.
