Reducing password frustration guideline

Document type:

Guideline

Version:

Final v3.0.0

Status:

CurrentNon-mandated

Owner:

QGCIO

Effective:

January 2025–current

Security classification:

Public

Category:

Cyber security

Purpose

Password frustration refers to the dissatisfaction and challenges experienced by users when managing multiple usernames and passwords. This is particularly the case when users are required to create complex passwords, remember numerous credentials, or change them frequently. This frustration often leads to insecure behaviours such as reusing passwords, creating weak passwords, or storing them improperly.

This guideline aims to address these issues by reducing password frustration while enhancing overall security and usability. It provides practical recommendations based on modern authentication standards, including the latest guidance from the National Institute of Standards and Technology (NIST) on Digital Identity and other industry references.

Advice

Adopt passwordless authentication methods

Passwordless authentication, such as security keys, Windows Hello for Business, and certificates, eliminates dependency on a long password for security, and instead uses either a biometric or shorter password in conjunction with a cryptographic device/software.

The transition to passwordless authentication presents advantages for organisations, particularly in terms of bolstering security and enhancing user acceptance. One advantage of passwordless authentication is its inherent resistance to phishing attacks. Traditional password-based systems are often vulnerable to such attacks, with users inadvertently divulging their credentials. However, in a passwordless framework, this risk is substantially mitigated as there are no passwords to be compromised.

Passwordless authentication tends to be more favourably received by users. The elimination of the need to remember and manage an array of complex passwords not only simplifies the user experience but also reduces the resources expended on password recovery and resets.

Implement single sign on

Leverage single sign on capabilities, such as SAML or OpenID Connect, to reduce the number of credentials that a user needs to maintain. This has additional advantages of:

• allowing entities to specify the credential types that users can use.
• being able to disable access to cloud applications centrally when a user no longer has a business requirement to access them. 
  
  
  Note: For this to be effective, implementers should consider if applications have other entry mechanisms such as long-lived sessions in mobile applications.

Requiring users to have multiple passwords also runs the risk that users will reuse the same password across multiple services, increasing the risk to all services if a single service has been compromised.

Limit re-authentication requirements

Over-authentication can lead to users becoming less attentive to the authentication process. This lack of attention can increase their vulnerability to phishing, where they may inadvertently provide their authentication details to a malicious site.

Modern methods, such as “risk based access control” can assist in reducing reauthentication requirements by analysing user behaviour, location, device security posture, and other contextual factors. Risk-based authentication systems can make intelligent decisions about when to request additional authentication. Rather than applying blanket policies that require frequent re-authentication and thus contribute to user fatigue, risk-based controls tailor the need for additional verification to situations where there is an actual indication of risk.

Consider a practical scenario. A user is accessing Office365 using Windows Hello for Business, a multi-factor authentication method, on a managed device. In this case, requiring the user to re-authenticate every day to Office365 may not add significant value. Instead, it could lead to user fatigue and a casual attitude towards the authentication process. This could potentially decrease the overall security, contrary to the intended purpose of enhancing it.

Don’t force arbitrary password expiry

Frequent resets of passwords are a significant contributor to poor password management practices, most commonly by encouraging users to write down their passwords to remember them, choosing simple passwords and trivial patterns. Almost all leading approaches to password management recommend against setting a forced password expiry.

Most password resets made by users include trivial changes such as incrementing a number at the end of the password by one or using some other simple formula or pattern to modify the existing password and are therefore easily guessed by malicious actors, who may have the previous password, within a few attempts.

Passwords should be reset immediately if:

• they are compromised, or suspected of being compromised
• they have been shared
• they are transmitted over a network without encryption.

Instead, a robust authentication policy which promotes the use of multifactor authentication where possible and requires passwords which are resistant to on-line and off-line brute force attack, should be adopted.

Promote passphrases over passwords

Traditional thinking around passwords has been that a good password requires a level of complexity, including upper- and lower-case letters, numerals and punctuation marks. However, in practice this has led to users adopting practices which ultimately lead to weaker passwords.

Common behaviours include:

• always having an exclamation mark at the end
• using a consistent password, with a number which is incremented each time the password is changed.

Current thinking, which is becoming more widely accepted is that educating users to use passphrases made from multiple unrelated words without requiring different character types is significantly better as it supports creating longer and more memorable passwords.

Educate users

To promote better password hygiene, it's important to educate users on good practices related to password management. The following points should be emphasised to all users:

• adoption of passphrases: reinforce the shift from complex passwords to the use of passphrases, consisting of a string of unrelated words, to enhance memorability and strength against attacks
• effective use of password managers: guide users towards the secure usage of password managers for creating and storing unique passwords and provide guidance on selecting an appropriate password manager that aligns with organisational standards
• multifactor authentication (MFA): emphasise the critical role of MFA in securing accounts by explaining the various MFA methods available and their respective resistance levels to phishing attempts.

Educate users not only on the 'how' of these practices but also the 'why,' as understanding the rationale behind security measures can lead to broader acceptance and compliance.  Consider highlighting how these support users personal use of technology as well as in work environments, as this will increase their overall cyber resilience.

Password Policy

The following password policy is suggested as a starting point, entities should undertake a risk assessment and determine a policy based on their own requirements.

Setting	Value
Length	Min (1FA): 14 Min (always used with MFA): 6 Max: Optional, Not less than 64
Complexity	No
Expiry	No
Deny-lists for common passwords	Yes
Lockouts	On (5-10 attempts)
Password History	12