So what's the deal with passwords

I came across an article from CSIRT-MU saying that passwords are like toothbrushes — change them and don't share them. The headline is catchy enough to draw readers in. However, I came away somewhat disappointed by the article. In the section on creating passwords, one of many approaches is presented. Essentially the approach is fine. But you can't generalise that such a password will be unbreakable.

If only because tools exist that can build a custom dictionary based on specified parameters — something the cyber team co-organising the Cyber Czech exercise ought to know. With knowledge of the recommended password generation method — just look at what CSIRT teams recommend — you can build a fairly robust dictionary and run an offline attack on a powerful computer. Unless passwords are hashed with bcrypt, even this won't save you. The main threat today is exploitation of leaked passwords — there are many databases where such passwords are available. If your email appears in them, there's a very good chance your account is/was or will be compromised.

The note about a typical password is also inappropriate. The password has 8 characters. Who — while educating people on cybersecurity — uses such a short password? The standard is 13+ characters, lowercase, uppercase, numbers and a special character. How they're mixed is up to the user. The argument of "not wanting to scare them" is flimsy. Today, everyone needs to take protecting their accounts seriously enough.

The other points mentioned in the article will help users do that.

Password manager — can't do without one these days. Try KeePass or Bitwarden.
Same goes for two-factor authentication (SMS isn't ideal — far better is OTP, typically a six-digit code used to verify login; Authy or Google Authenticator). No exceptions, especially for important accounts. Everywhere it's supported. Without compromise. Tell people to take it seriously and demand it. Everywhere you have personal data, a debit or credit card, email, social media... almost everything except e-shops, right?

Writing passwords on sticky notes is solved by a password manager.

And changing your password? If the service prompts you to do so after a while, go ahead — but in practice it's pointless to change it every month. Definitely change it if the service has been compromised. But I see no reason to change passwords more than once every 6 or 9 months. Share your password? With no one, ever!