An NHS doctor I know recently had to do their online mandatory training questionnaire, which asks a bunch of questions about clinical practice, safety and security. This same questionnaire will have been sent to all the doctors in this NHS trust.

The questionnaire included the following question:


  Which of the following would make the most secure password? Select one:
  
  a. 6 letters including lower and upper case.
  b. 10 letters a mixture of upper and lower case.
  c. 7 characters that include a mixture of numbers, letters and special characters.
  d. 10 letters all upper case.
  e. 5 letters all in lower case.


They answered "b", and they lost a mark, as the "correct answer" was apparently "c".

It is my understanding that as a rule, extending password length adds more entropy than expanding the alphabet. I suppose the NHS might argue that people normally form long passwords out of very predictable words, making them easy to guess. But if you force people to introduce "special characters" they also tend to use them in very predictable ways that password guessing algorithms have no trouble with.

Although full disclosure, I'm not a password expert - I mostly got this impression from Randall Munroe (click for discussion):



Am I wrong?

By any measure, they're wrong:

Seven random printable ASCII: 957 = 69 833 729 609 375 possible passwords.

Ten random alphabetics: 5210 = 144 555 105 949 057 024 possible passwords, or over 2000 times as many.

Length counts.  If you're generating your passwords randomly, it counts for far more than any other method of making them hard to guess.
