Chapter 4 · 2003–2017

The rules

Uppercase, symbol, digit, rotate every 90 days. The whole world obeyed. The man who wrote the rules spent his retirement apologizing.

Faced with humans who choose “sunshine,” the industry made a fateful decision around the turn of the century: if people won’t choose strong passwords, we’ll require them to. In 2003 a NIST engineer named Bill Burr wrote the guidance that encoded the requirement — Special Publication 800-63, appendix on password composition — and within a few years it was law-adjacent everywhere. Your bank, your employer, your government: uppercase and lowercase and a digit and a symbol, changed every sixty or ninety days, no reuse.

It felt like rigor. It was the opposite. Walk the reversal below, because the numbers are the argument.

Consider what a human does when ordered to include a symbol and a number and to change it quarterly. They do not generate entropy. They take “password,” make it “Password1,” and when forced to rotate, they make it “Password2.” The rules didn’t produce unpredictable secrets. They produced predictable ones — and worse, they taught attackers the exact transformations to try, because everyone was mangling the same way under the same rules. Composition requirements shrank the real search space while appearing to grow it. Forced rotation was the cruelest part: it punished people for having a strong password by making them abandon it on a timer, and it pushed the weak ones toward incrementing counters and sticky notes under keyboards.

Burr, to his enormous credit, said so. In 2017, retired, he told the Wall Street Journal plainly: “Much of what I did I now regret.” The symbol soup, the rotation — mistakes, he said, based on reasoning that turned out to be wrong. It is one of the more honest things a standards author has ever done, and it dates the moment the industry admitted a fourteen-year error out loud.

The same year, NIST 800-63B replaced the rules with their near-inverse, and the new advice reads like a chapter-3 debrief. Stop forcing rotation — change a password when there’s evidence it’s compromised, not on a calendar. Drop the composition requirements. Do check new passwords against lists of known-breached ones (the RockYou census, weaponized for defense at last). And above all, favor length — a long passphrase beats a short tangle of symbols, exactly as chapter 3’s cracking slider showed. Allow paste, allow long inputs, stop the theater.

Here is why this chapter is the thesis at its sharpest. For fourteen years the industry poured enormous effort into the one thing that couldn’t be fixed by effort — the secret itself, the human’s choice — while the actual control, the management around the secret, was where all the real progress lived: better storage, breach-list checking, and the second factors and federation the branches ahead are about. The rules era is what it looks like when an industry works hard on the wrong layer.

And notice the tell that the password was never going away: even the reform is about how to choose and manage passwords better. Nobody in 2017 proposed removing them. The network had already forced a bigger question — not “how strong is this password” but “how do you even know it’s the right person, coming from anywhere in the world?” That question splits the whole story in two, and it’s chapter 5’s fork.