Most of us learned the same password rules: at least eight characters, a capital, a number, a symbol, and change it every ninety days. Nearly all of that advice has since been retired — and the part most people skipped turns out to be the most important.
What actually goes wrong
Attackers rarely guess passwords. They reuse them.
When any website you have ever signed up for is breached — a retailer, a forum, a newsletter you forgot about — the email addresses and passwords from that site end up on a list. Software then tries every pair on that list against hundreds of other services. Your bank. Your email. Your donor database. Each attempt costs the attacker nothing, and it works often enough to be worth doing at enormous scale.
That is why a password’s cleverness barely matters. A short string of symbols is no safer than a long plain one if you have used it in two places and one of them has been breached.
What the guidance actually says now
NIST, whose digital identity guidelines underpin most security policies in the United States, now recommends against most of what we were all taught:
- Don’t impose composition rules. Requiring a symbol and a number mostly produces predictable modifications, not stronger secrets.
- Don’t force periodic changes. People who know a reset is coming pick weaker passwords and then increment them — Spring, Summer, Autumn. Change on evidence of compromise instead.
- Do screen new passwords against lists of known breached ones.
- Allow pasting so people can use a password manager.
Length is what’s left, and length is what works. A passphrase of four unrelated words is easier to remember and harder to crack than eight characters of punctuation.
Why this bites nonprofits harder
Turnover. Volunteers, interns, board members, and contractors all pass through your accounts, and each brings their own password habits. When a volunteer reuses the password from their personal email in your donor database, they quietly import their entire breach history into your organization.
Shared accounts compound it. One reused password on one shared login exposes everyone who uses that login.
What to do this week
- Check your work email address at haveibeenpwned.com. It is free; you never enter a password — only your address — and it tells you which breaches you appear in.
- Change anything that shows up, starting with email. Email is the reset path for every other account you own, so it goes first.
- If your organization forces a password change every ninety days, stop. Switch to changing on evidence of compromise.
- Make length the rule rather than symbols. Four unrelated words beat eight characters of punctuation.
That is the whole of it. This is the least interesting post in the series and probably the highest-return one.
Next in this section: why the spreadsheet of passwords persists, and the tool that actually replaces it.