The UK intelligence agency responsible for vast amounts of snooping, as exposed by the Snowden revelations, has released new password guidelines.



GCHQ and the Centre for the Protection of National Infrastructure have released a report entitled “Password guidance: simplifying your approach”, which suggests that complex passwords are no longer recommended.

The agency instead recommends using passwords made from three random words, using password managers and jettisoning overly complex password rules in favour of systems capable of detecting unauthorised activity.

The suggestions seem sensible at face value, allowing users to remember passwords and not forcing them to reuse complex strings of letters, numbers and special characters for many services because they can only remember one or two.

However, some will be sceptical about trusting the advice of the intelligence agency of a government which has pushed for backdoors within software and the weakening of encryption used to protect user data for surveillance purposes.

In particular, GCHQ’s advocacy of password managers brings into question whether they are target of the agency’s efforts to achieve backdoors into products. The report warns that “like any piece of security software, they are not impregnable and are an attractive target”.

Ciaran Martin, director general of cyber security for GCHQ, said: “Complex passwords do not usually frustrate attackers, yet they make daily life much harder for users.”

Change defaults

The report includes common sense advice such as “all default vendor-supplied passwords that come with any system or software should be changed before deployment” and “never allow password-sharing between users”.

GCHQ also recommends having higher levels of security for administrators and remote workers, who it says should be forced to use two-factor authentication to protect their accounts.

Nigel Hawthorn from security company Skyhigh Networks said: “The security industry is awash with password advice, but much of it is contradictory or simply not suited to modern working. The result – passwords still puzzle many. GCHQ’s latest advice is refreshingly to the point and covers some of the most pressing issues facing UK businesses and employees today.”

Martin caveats GCHQ advice, however, saying that it is “not intended to protect high-value individuals using public services”, which essentially means that it is appropriate for the public, but not GCHQ.

What do you think of GCHQ’s advice? Welcome insight from the experts – or a bit rich coming from the agency that doesn’t need passwords to look at your mail? Let us know in the comments below.





