Are your passwords future-proof?

Q1. Which survey pattern best matches the findings about password reuse?
- Most people reuse passwords, and employees may reuse one password about 13 times.
- Most people use a different password for every account.
- Password managers are used by most internet users.
- Password reuse is rare, under 10%.
Answer: Most people reuse passwords, and employees may reuse one password about 13 times[[cite:1]][[cite:2]].
Q2. Which pairing best matches the findings on password length and password-manager adoption?
- 64% of Americans report passwords of 8 to 11 characters, and password-manager use is about 30% to 34%.
- 64% of Americans report passwords over 12 characters, and password-manager use is under 10%.
- 20% of Americans report passwords of 8 to 11 characters, and managers are used by most users.
- 84% of people use password managers, and most passwords are 15 characters or longer.
Answer: 64% of Americans report passwords of 8 to 11 characters, and password-manager use is about 30% to 34%[[cite:3]][[cite:4]][[cite:5]].
Q3. Which set of password rules matches NIST SP 800-63B-4 guidance?
- 15 characters minimum for single-factor, 8 for MFA-only, no extra composition rules, allow password managers, and do not require periodic password changes.
- 12 characters minimum for everyone, require mixed character classes, block password managers, and force monthly rotation.
- 8 characters minimum for single-factor, 15 for MFA-only, require special characters, and require annual rotation.
- No minimum length at all if a password manager is used.
Answer: 15 characters minimum for single-factor, 8 for MFA-only, no extra composition rules, allow password managers, and do not require periodic password changes.
Q4. Which storage guidance matches the OWASP Password Storage Cheat Sheet?
- Use Argon2id, add a unique salt to each password, and use a work factor that can be increased over time.
- Store passwords in plaintext and rely on TLS.
- Use SHA-256 without salts because it is fast.
- Encrypt passwords with the same key for every user.
Answer: Use Argon2id, add a unique salt to each password, and use a work factor that can be increased over time.
Q5. What does NIST's PQC FAQ say about Grover's algorithm and practical attacks?
- It gives a quadratic speedup in theory, but real-world limits like expensive quantum hardware and the need to run Grover steps in series reduce the practical advantage, so it may provide little or no advantage.
- It makes all brute-force password attacks impossible.
- It guarantees that 128-bit AES is broken quickly.
- It removes the need for any classical security analysis.
Answer: It gives a quadratic speedup in theory, but real-world limits like expensive quantum hardware and the need to run Grover steps in series reduce the practical advantage, so it may provide little or no advantage.
Q6. What can you conclude from the supplied survey evidence about password changes after a breach?
- The supplied survey evidence does not provide a reliable percentage for changing passwords after a breach.
- 84% of people change passwords immediately after a breach.
- 20% of people change passwords after a breach.
- Password-manager users never change passwords after a breach.
Answer: The supplied survey evidence does not provide a reliable percentage for changing passwords after a breach[[cite:6]][[cite:7]].

Use Password Managers To Track Their Passwords

Are your passwords future-proof?

Follow Up Recommendations

Explore related topics