Thread: Password Stupidity

Password Stupidity

Our IT mob keep upping the security requirements for passwords (well, it’s easier than fixing all the bloody IT issues)

Now has to:

- Be at least 11 characters
- Contain at least one upper case letter
- Contain at least one lower case letter
- Contain at least one number
- Contain at least one symbol character
- NOT be any variation of a previous password.
- NOT contain any element of your d.o.b, telephone nnumber or address.

The above are all apparently cross-referenced with HR system data and so on.

We are also advised that (and this may be mandated future) that the password should not include any dictionary word in any language.

Sigh.


As if that’s not enough they provide some examples (with the warning not to use any of the examples as your password, of course)

Helpfully, they say that constructing passwords in the following manner makes them strong but at the same time easy to remember.

I call bull**** on the latter.

June School Holidays can be modified to: 7un3Schoo1Ho!id@ys;
Somewhere over the rainbow, blue birds fly can be modified to 5w0tR,Bbf};
I like Australian red wine can be modified to: IL077ieR3dw!ne*;
Be good, be wise can be modified to: B3g00db3wi5e$.

Hmmm. I'd remember each of those for about 3 seconds.....

All this would accomplish is promoting the security sin of writing down the password so as not to forget it ! Dickheads.

Do you work for an American company by any chance Vlad? Any company over a certain size that is based in the States has to comply with the Sarbanes-Oxley Act (SOX) - Sarbanes–Oxley_Act of which one part is password security that requires that level of complexity. Either that, or your IT team have been reading up on it and thought it was a good idea...

Been through SOX compliance with a previous company. Stupid thing was that it had the opposite effect in reality as everyone just wrote their passwords down as they could never remember them...