Yo Motherboard

What's the Best Password Policy for 2025?

September 21, 2025 5 answers
Asked by CuriousCat99
I recently received a password policy for review that seems to be taking us back a decade. We've already had a solid policy in place for years, so I'm confused as to why a new one is needed. The current draft doesn't mention biometrics or Single Sign-On (SSO) and only briefly touches on Multi-Factor Authentication (MFA). I'm curious—what password policies are others using nowadays? Can anyone share some templates or best practices?
biometrics IT standards MFA password policy Passwordless Security+ System Operations

Answers

PasskeyAdvocate
The future is passkeys! Just think about how secure they are compared to outdated password policies. We need to push for more adoption of that tech. It’s about time.

SkepticalTechie: Are people actually adopting passkeys widely, though? It seems like a tough sell to leadership who are used to seeing traditional systems.

Reply to this answer
SmartCardFan
We ditched passwords entirely last year! Now everyone uses FIDO tokens or Windows Hello. It’s been a game changer, but some places are still stuck on old policies. Root passwords get rotated yearly. Everyone loves how easy it is—once they get past the initial learning curve!

OldSkoolAdmin: I miss the simplicity of just using a smart card to log in at the office. But at my new job? They are so hesitant to make that switch—driving me nuts!

CuriousCat99: What do you do for shared devices, though? Do you just use PINs?

Reply to this answer
SarcasticAdmin
Or, we could just make one account for everyone with a single password that never expires! Sounds secure, right? Just kidding!
Reply to this answer
ComplexityKnight
Our requirement is a 16-character password that includes upper and lower case letters, special characters, and numbers, changed every year. It's not ideal, but user feedback has helped us switch to this more complex yet less frequent change policy, which they tolerate better. Users still dislike it though!

FedUpUser: I think setting passwords to expire once a year contributes to users choosing terrible passwords just to comply. We need to get rid of that practice!

DoubtfulAdmin: Yeah, I heard NIST suggested dropping those extra complexity requirements altogether... maybe we should consider that?

Reply to this answer
TechGuru42
You might want to check out the NIST authentication guidelines. They're quite comprehensive and push for modern practices, including security without frequent password changes. Here's a link: [NIST guidelines](https://pages.nist.gov/800-63-4/sp800-63b.html)

SkepticalUser22: Yeah, I read those, but aren't we just supposed to never change our passwords anymore? That seems a bit risky, right?

ConfusedDude18: Exactly! It feels like a constant fight trying to convince people that we need to adapt.

TechWhiz88: True, but security evolves. It's about balancing user experience with safety.

Reply to this answer

Add your answer

Answers are reviewed before publication.

Related Discussions