Better password policy: Complex? or longer passwords?

What is the better password policy?

A longer password like NIST 800-53 says?

Key NIST password guidelines

• Minimum length of 8 characters and maximum length of at least 64 characters if chosen by the user.
• Allow usage of ASCII characters (including space) and Unicode characters.
• Check prospective passwords against a list that contains values known to be commonly used, expected, or compromised. This includes passwords obtained from previous breach corpuses, dictionary Words, repetitive or sequential characters (‘aaaaaa’, ‘1234abcd’, etc.) and context-specific words, such as the name of the service, the username, and derivatives thereof.
• Limit consecutive failed authentication attempts on a single account to no more than 100.
• Allow “paste” functionality while entering a password.
• Provide a password strength meter.
• No complexity requirements or password expiration period.
• Enforce multi-factor authentication (MFA).
• Store passwords in a form resistant to offline attacks.
• Passwords shall be salted and hashed.

(Some of this information was brought from Securden.com blogpost)

NIST 800-63B Digital identity guidelines from 2017, but here is an updated version of this document:

The updated version is here from NIST 800-63B with errata  (2020)

A.2 Length

Password length has been found to be a primary factor in characterizing password strength [Strength] [Composition]. Passwords that are too short yield to brute force attacks as well as to dictionary attacks using words and commonly chosen passwords.

The minimum password length that should be required depends to a large extent on the threat model being addressed. Online attacks where the attacker attempts to log in by guessing the password can be mitigated by limiting the rate of login attempts permitted. In order to prevent an attacker (or a persistent claimant with poor typing skills) from easily inflicting a denial-of-service attack on the subscriber by making many incorrect guesses, passwords need to be complex enough that rate limiting does not occur after a modest number of erroneous attempts, but does occur before there is a significant chance of a successful guess.

Offline attacks are sometimes possible when one or more hashed passwords is obtained by the attacker through a database breach. The ability of the attacker to determine one or more users’ passwords depends on the way in which the password is stored. Commonly, passwords are salted with a random value and hashed, preferably using a computationally expensive algorithm. Even with such measures, the current ability of attackers to compute many billions of hashes per second with no rate limiting requires passwords intended to resist such attacks to be orders of magnitude more complex than those that are expected to resist only online attacks.

Users should be encouraged to make their passwords as lengthy as they want, within reason. Since the size of a hashed password is independent of its length, there is no reason not to permit the use of lengthy passwords (or pass phrases) if the user wishes. Extremely long passwords (perhaps megabytes in length) could conceivably require excessive processing time to hash, so it is reasonable to have some limit.

A.3 Complexity

As noted above, composition rules are commonly used in an attempt to increase the difficulty of guessing user-chosen passwords. Research has shown, however, that users respond in very predictable ways to the requirements imposed by composition rules [Policies]. For example, a user that might have chosen “password” as their password would be relatively likely to choose “Password1” if required to include an uppercase letter and a number, or “Password1!” if a symbol is also required.

Users also express frustration when attempts to create complex passwords are rejected by online services. Many services reject passwords with spaces and various special characters. In some cases, the special characters that are not accepted might be an effort to avoid attacks like SQL injection that depend on those characters. But a properly hashed password would not be sent intact to a database in any case, so such precautions are unnecessary. Users should also be able to include space characters to allow the use of phrases. Spaces themselves, however, add little to the complexity of passwords and may introduce usability issues (e.g., the undetected use of two spaces rather than one), so it may be beneficial to remove repeated spaces in typed passwords prior to verification.

Users’ password choices are very predictable, so attackers are likely to guess passwords that have been successful in the past. These include dictionary words and passwords from previous breaches, such as the “Password1!” example above. For this reason, it is recommended that passwords chosen by users be compared against a “black list” of unacceptable passwords. This list should include passwords from previous breach corpuses, dictionary words, and specific words (such as the name of the service itself) that users are likely to choose. Since user choice of passwords will also be governed by a minimum length requirement, this dictionary need only include entries meeting that requirement.

Highly complex memorized secrets introduce a new potential vulnerability: they are less likely to be memorable, and it is more likely that they will be written down or stored electronically in an unsafe manner. While these practices are not necessarily vulnerable, statistically some methods of recording such secrets will be. This is an additional motivation not to require excessively long or complex memorized secrets.

Thus  our question must be answered with relevant information – Complex passwords seem like they would take longer to crack, but since computer speeds are always increasing the actual length of passwords (or the entropy of the password)matters more than the complexity.

Another aspect is how people actually run their password management functions. If one has to create a password every 90 days and it has to be complex, what are the chances you can remember 4 new passwords every year? After 3 years one has to have 12 new passwords which are complex. (Upper case, Lower case, numbers, and special characters).

Instead if one can put several words(which could have uppercase/lower case) with a number

I asked Gab AI:    complex passwords or long passwords?

Long passwords are generally more secure than complex passwords. While complex passwords can be difficult to remember and type, a long password with a mix of characters, numbers, and symbols is more challenging for hackers to crack. This is because the longer the password, the more possible combinations there are, making it harder for brute-force attacks to succeed.

How about  you.com AI?  Ask “complex passwords or long passwords?”

Can I combine both for maximum security?