Most suffocating password policy ever

[lrad50]

most college websites are worse

 

[Armitage]

Originally posted by: spidey07

Originally posted by: KillerCharlie

Originally posted by: Alkesh
My friend works at a hedge fun and the PW he has for his e-mail is only half of the password, the other half is on a keychain assigned to him that randomizes the numbers ever five minutes. In order to check his mail he has to put in the correct code at the correct time in additon to the part only he knows.

Now that would suck.

It's called two factor authentitcation and actually is growig in popularity.

Lot better than just a username/password

I think I heard something recently that online banking sites are going to have to go to that soon.
That's how our VPN access at work is - RSA card.

 

[imported_Phil]

At my old company, one of the Directors had a password of... you guessed it... "password". And somehow, he'd lock his account out two or three times per week and need it unlocked. How do you miss-type "password" every other morning?

 

[djheater]

Ten pounds IS NOT bulk!!!

oops, I meant

That's not a very restrictive policy!!!

 

[Argo]

This isn't even close to the most suffocating. Try all of the above, plus it cannot contain any english words in it, plus you have to change it every 3 months.

 

[imported_Phil]

Originally posted by: djheater
Ten pounds IS NOT bulk!!!

oops, I meant

That's not a very restrictive policy!!!

Can you imagine how much more work we would have had were we to switch to complex?

 

[jagec]

Originally posted by: TallBill
Not even close.

Must contain between 8-12 characters.
Must contain at least 2 upper case letters.
Must contain at least 2 lower case letters.
Must contain 2 numeric characters.
Must contain two non alphanumeric characters (!,@,#,$, etc)

The only problem my two "secure" passwords have with that policy is that they're too long

No problem with the OP's requirements, though...

Originally posted by: Armitage
That's similar to the rules at some places I've worked. In addition, they regularly run dictionary attacks against the password files using several languages including Klingon and various slang dictionaries.

That's why you break out the 1337 and start replacing a couple letters with numbers or symbols. That way you can use an easy-to-remember password, and still be secure.

 

[Kyteland]

The password B(.)(.)B13s seems to fit all of your rules.

 

[shortylickens]

Am I the only person here who realizes these policies dont actually secure sh1t?
If they were really worried about security they would get thumb scanners or something.

But, like so many issues related to saftey and security, its cheaper and easier to keep pushing the BS, inneffective methods that dont do jack, just so people can FEEL safer.
Because FEELING safer is much more desirable to a fool than actually BEING safe.

 

[Ilmater]

Originally posted by: TallBill
Not even close.

Must contain between 8-12 characters.
Must contain at least 2 upper case letters.
Must contain at least 2 lower case letters.
Must contain 2 numeric characters.
Must contain two non alphanumeric characters (!,@,#,$, etc)

Oooh, one of ours is close (I have 26 different passwords in use at my company currently, so this is just one of them):

At least 8 characters
At least 1 upper-case character
At least 1 lower-case character
At least 1 numeric character
At least 1 non-alphanumeric character

 

[jagec]

Originally posted by: shortylickens
Am I the only person here who realizes these policies dont actually secure sh1t?
If they were really worried about security they would get thumb scanners or something.

But, like so many issues related to saftey and security, its cheaper and easier to keep pushing the BS, inneffective methods that dont do jack, just so people can FEEL safer.
Because FEELING safer is much more desirable to a fool than actually BEING safe.

Hate to break it to you, but a solid password, that you DON'T write on a sticky note to remember, is much more secure than a thumb scanner. Biometrics tends to be easy to fool.

 

[shortylickens]

You didnt hate breaking anything to me. You liked it.

In the words of George Constanza "Or something. I said Or Something."
I was actually thinking of a smart card along with the password.

 

[GoingUp]

At my company I have all of the above, password changes every month and you cant reuse any of your last 12 passwords

 

[Hummin]

Originally posted by: jagec

Originally posted by: shortylickens
Am I the only person here who realizes these policies dont actually secure sh1t?
If they were really worried about security they would get thumb scanners or something.

But, like so many issues related to saftey and security, its cheaper and easier to keep pushing the BS, inneffective methods that dont do jack, just so people can FEEL safer.
Because FEELING safer is much more desirable to a fool than actually BEING safe.

Hate to break it to you, but a solid password, that you DON'T write on a sticky note to remember, is much more secure than a thumb scanner. Biometrics tends to be easy to fool.

Gummi bears, anyone?

 

[Armitage]

Originally posted by: jagec

Originally posted by: TallBill
Not even close.

Must contain between 8-12 characters.
Must contain at least 2 upper case letters.
Must contain at least 2 lower case letters.
Must contain 2 numeric characters.
Must contain two non alphanumeric characters (!,@,#,$, etc)

The only problem my two "secure" passwords have with that policy is that they're too long

No problem with the OP's requirements, though...

Originally posted by: Armitage
That's similar to the rules at some places I've worked. In addition, they regularly run dictionary attacks against the password files using several languages including Klingon and various slang dictionaries.

That's why you break out the 1337 and start replacing a couple letters with numbers or symbols. That way you can use an easy-to-remember password, and still be secure.

I'm sure some of the more common 1337 is in the slang dictionaries.

 

[Zaitsevs]

put your name into leet

 

[CVSiN]

Originally posted by: shortylickens
You didnt hate breaking anything to me. You liked it.

In the words of George Constanza "Or something. I said Or Something."
I was actually thinking of a smart card along with the password.

we use smart cards here.. i like them alot..

 

[sao123]

does anyone use secure id 16 digit keyfobs for passwords?

 

[Eli]

Originally posted by: Armitage

Originally posted by: TallBill
Not even close.

Must contain between 8-12 characters.
Must contain at least 2 upper case letters.
Must contain at least 2 lower case letters.
Must contain 2 numeric characters.
Must contain two non alphanumeric characters (!,@,#,$, etc)

That's similar to the rules at some places I've worked. In addition, they regularly run dictionary attacks against the password files using several languages including Klingon and various slang dictionaries.

Jeebus Christ, WTF? LOL

 

[cpacini]

Originally posted by: spidey07

Originally posted by: KillerCharlie

Originally posted by: Alkesh
My friend works at a hedge fun and the PW he has for his e-mail is only half of the password, the other half is on a keychain assigned to him that randomizes the numbers ever five minutes. In order to check his mail he has to put in the correct code at the correct time in additon to the part only he knows.

Now that would suck.

It's called two factor authentitcation and actually is growig in popularity.

Lot better than just a username/password

MLS uses that system as well, athough it is really designed to prevent cheap realtors from sharing accounts, not security.

 

[thirdlegstump]

Y0uR_m0M_(_!_)_after_m3_(_8_)

 

[cavemanmoron]

K1ssmyA$$$

LOL

 

[Pepsei]

I think Charlotte1 fits right? that's our local admin password for every servers. Ok, I'm lying, but it's close.

 

[spidey07]

Originally posted by: Pepsei
I think Charlotte1 fits right? that's our local admin password for every servers. Ok, I'm lying, but it's close.

heh, for a while this was my standard...

H0und!3y3

yep, original half-life reference.

 

[Apathetic]

Here's our policy:

15 character minimum (i'm not making this up)
must contain 1 or more upper, 1 or more lower, 1 or more symbol, 1 or more digits
changed every 45 days
remebers the past 10 or 12 (i don't remember which)
not allowed to end with a digit
not allowed to simply increment the digit in the password

shoot me

Dave