Chronicle the Ninth · On the Appointment of the Horse

How Strong Is My Password? The Royal Horse Decides

The court dismissed its password strength meter in the spring, after it awarded five green bars to "Dragon2019!". It has been replaced by a horse. The horse's name is Staple. His record remains perfect.

The procedure is dignified. The subject approaches the paddock, whispers their password to the clerk, and the clerk reads it to Staple. One neigh signifies approval. Silence signifies rejection. A long look over the fence, held until the subject leaves, signifies that the password was "password" and that Staple is disappointed on a personal level.

Selected verdicts from the paddock

The Chancellor submitted "Chancellor1". Silence. He appealed on grounds of seniority. Staple ate an apple at him.
The Squire of Shadow IT submitted the same password twice, under the impression this doubled its strength. Staple lay down.
A visiting merchant submitted a password of sixteen random characters kept in a password manager. One clean neigh. The merchant wept. The paddock applauded.
A stable lad submitted four random words strung together, long as a fence rail and easy to remember. Staple neighed twice, an honour previously reserved for hay.
The King himself submitted a password. The verdict is sealed by royal order. Staple has been given a larger paddock for unrelated reasons.

From these proceedings the learned extracted the pattern, which they insist on writing down: length beats cleverness, random beats memorable-to-you-guessable-to-all, four unrelated words serve a human memory well, and a password manager serves everything else, for it alone can hold two hundred different keys without lying down. The court thanks the learned and reminds them the credit belongs to the horse.

Sire, I asked one of the famous machine oracles to judge passwords instead, for it claims the wisdom of all mankind. It rated "St4ple!" as "very strong". Staple rated it by attempting to eat the clerk. Sire, the horse stays.

The promotion

Following his flawless season, the court has reached the only conclusion available to serious people: Staple has been appointed Chief Information Security Officer of the realm, with a corner paddock and authority over the firewall. His first policy, "no", has already prevented four incidents and one merger. His second policy is oats. The transformation programme is ahead of schedule, because he refuses to attend meetings, which the consultants agree is where transformation programmes die.

ROYAL THREAT LEDGER, THE PADDOCK [■■■■■■■■■□] Passwords rejected by Staple ..... MOST [■■■■■■■■□□] Verdicts later proven correct .... ALL TO DATE [■■■■■□□□□□] Apples consumed in judgement ..... TRIBUNAL'S SHARE [□□□□□□□□□□] Meetings attended as CISO ........ THE SECRET

Subjects ask: sire, is it wise to entrust the kingdom's security to a horse? Subject, the previous meter approved "Dragon2019!". The horse has never approved anything with a birth year in it. In this court we promote on merit.