Odd password requirement

[Exterous]

Password must be 6 to 12 characters long but exclude 9 character combinations

And of course the password I would use for this is 9 characters long. Is there some reason that 6-8 or 10-12 character passwords are ok but 9 isn't? I tried it anyway - just to be sure but it was rejected.

 

[spacejamz]

are you sure that your 9 character password meets all of the other requirements?

 

[SandEagle]

http://www.ntsols.com/newsletter/ezines/issue23/9-character-passwords-no-longer-secure.htm

 

[Exterous]

are you sure that your 9 character password meets all of the other requirements?

Yes. The only other requirements were that it couldn't be same letter or number repeated or consecutive numbers (aaaaaa, 123456)

http://www.ntsols.com/newsletter/ezines/issue23/9-character-passwords-no-longer-secure.htm

It says up to 9 characters so why would they still allow 6-8 lengths?

 

[JTsyo]

http://www.ntsols.com/newsletter/ezines/issue23/9-character-passwords-no-longer-secure.htm

but then 6-8 would be worse than 9.

 

[Gunslinger08]

Maybe to prevent you from using your SSN (or employee ID) as your password.

 

[Exterous]

Maybe to prevent you from using your SSN (or employee ID) as your password.

Ah - good thought. It is for a financial institution

 

[sourceninja]

Only 12 long, that would exclude all of my passwords....

 

[JujuFish]

Any password implementation that has a maximum length is terrible.

 

[rivan]

http://www.ntsols.com/newsletter/ezines/issue23/9-character-passwords-no-longer-secure.htm

Reading that article, why would any modern system not just make someone wait before trying another password?

It seems easy to preclude brute force attacks by adding in a pause before another password could be attempted/responded to. Even a half second would essentially stop brute force attacks.

 

[_Rick_]

These attacks are on captured hashes, not against an authentication system.

 

[Pulsar]

Insane password requirements are just overworked underpaid programmers getting the last laugh. It's just like the instructions to put together an office chair where everything is the same size until you come to the last bolt, which is one of those tamper proof torx bolts with no installation tool: you know somewhere out there an engineer is laughing maniacally.

 

[Dallascisco]

That's odd, why do all of our passwords require the word penis in them............

 

[T_Yamamoto]

Maybe to prevent you from using your SSN (or employee ID) as your password.

Clever thinking.

Who uses their ss number as a password?

 

[Saint Nick]

Well duh ... because 7 8 9.

 

[darkewaffle]

Clever thinking.

Who uses their ss number as a password?

There are a ton of customers who use their SSN number as their login ID where I work.

 

[Pulsar]

There are a ton of customers who use their SSN number as their login ID where I work.

We have to change ours every 30 days.

 

[Exterous]

Well duh ... because 7 8 9.

Har

We have to change ours every 30 days.

Man - changing your SS number every 30 days must be a real pain in the ass.

 

[Puppies04]

http://http://www.youtube.com/watch?v=fcG7ftYMObA

Reminded me of this.