If you want to use a Microsoft service and try to create an account, the company will not allow you to use a frequently encountered security code.
The same approach applies in preview phase for Azure users Active Directory and, over the next few months, will roll out to other Microsoft services.
What are the common codes? accesss?
Alex Weinert, Group Program Manager of Azure AD Identity Protection, explained he decided which passwords are too common.
His team created an automated system powered by lists of usernames and passwords stolen from other companies and organizations, and leaked online or offered for sale, and a list of usernames and passwords captured in over 10 million brute force attacks that are made daily in the company's systems (it is a constantly updated list).
Based on this data, the system recognizes which codes are repeated more frequently, and blocks the selection of such passwords.
Additional security options
Interestingly, when Microsoft asks users to choose a password, it makes it with a unique requirement to have from 8 characters and up.
The company chose not to ask for larger codes or enriched with symbol characters to add complexity, and advises IT administrators not to force users to periodically reset their account passwords.
Why
Because users according to the company react in a predictable way when confronted with similar constraints.
From a previous survey, Microsoft discovered that:
- In additional and mandatory password requirements, customers typically use repeating patterns (eg passwordpassword), choosing to write their passwords twice.
- Complexity requirements in passwords lead to identical password models using e.g. a first capital letter, one symbol in the last one, and a number in the last two, which makes them vulnerable to brute-force attacks.
- The obligatory transitive reset of passwords results in the selection of previous passwords, i.e. the passwords are "updated" to older ones.
More recommendations for managing passwords for users and administrators are provided in the following White Paper. You'll also find tips on how to choose a good (strong and unique) password, and other practices to keep your data safe.
Microsoft Password Guidance (PDF)
