I worked in a “secure” facility where the password restrictions were “Must have two upper, two lower, two letters, 12 characters, and not contain any dictionary words.” And you had to change it every 30 days. People forgot their passwords so often that everyone either had it on a post-it on their monitor or they had to call IT to retrieve it so often that IT just started trusting people and giving out passwords over the phone for anyone who knew the username. I facepalmed so hard…
Microsoft did a study not too long ago showing the inefficiency of changing passwords too often like that.
Most of the reasons behind why it was a bad idea you just mentioned… People writing it down or requesting it so often from IT that they just give it out and so on.
I’ve read about a study a few months ago that concluded that longer passwords are stronger than ones with too many special characters. Trying to implement security is such a pain in the @ss. Whenever I do a website I try to implement openid or facebook connect logins since people are more likely to remember those passwords to cut down on the money pit that is account login troubleshooting.
So far so good, but I will rue the day, they find extreme flaws with those two systems.
I also had a bank with a website that required your password to be exactly 2 upper followed by exactly 2 lower followed by exactly 2 numbers. So 6 characters, each one limited to a small range. It’s not like someone could brute force it because it locked out after 3 attempts but still, that’s going to force guessable password. I bet half of them were ABcd12. Or first four of username followed by 11. I switched banks.
You forgot the two special characters, but not all of the ones on the numbers at the top of the keyboard, only SOME. And you can’t use the same two characters in a row. And if you didn’t get it within 3 tries, you’re permanently locked out until IT decides to maybe help you out.
This sounds just like my job. 8 different programs, all requiring an 8-character password, which must include 1 upper, 1 lower, 2 numbers, 1 special character, no consecutive repetition of characters, and no password that has been used previously. And we’re going to tell you that it’s good for 60 days but we’ll start bugging you to change it in 45.
DAH!
BENDY!……………………………………………………………well done
I worked in a “secure” facility where the password restrictions were “Must have two upper, two lower, two letters, 12 characters, and not contain any dictionary words.” And you had to change it every 30 days. People forgot their passwords so often that everyone either had it on a post-it on their monitor or they had to call IT to retrieve it so often that IT just started trusting people and giving out passwords over the phone for anyone who knew the username. I facepalmed so hard…
Microsoft did a study not too long ago showing the inefficiency of changing passwords too often like that.
Most of the reasons behind why it was a bad idea you just mentioned… People writing it down or requesting it so often from IT that they just give it out and so on.
I’ve read about a study a few months ago that concluded that longer passwords are stronger than ones with too many special characters. Trying to implement security is such a pain in the @ss. Whenever I do a website I try to implement openid or facebook connect logins since people are more likely to remember those passwords to cut down on the money pit that is account login troubleshooting.
So far so good, but I will rue the day, they find extreme flaws with those two systems.
That sounds dope. A good password, I reckon, is a sentence that makes absolutely no sense at all mixed with 1337 5p34k.
I also had a bank with a website that required your password to be exactly 2 upper followed by exactly 2 lower followed by exactly 2 numbers. So 6 characters, each one limited to a small range. It’s not like someone could brute force it because it locked out after 3 attempts but still, that’s going to force guessable password. I bet half of them were ABcd12. Or first four of username followed by 11. I switched banks.
I was about to say, this is why people never remember their passwords…
You forgot the two special characters, but not all of the ones on the numbers at the top of the keyboard, only SOME. And you can’t use the same two characters in a row. And if you didn’t get it within 3 tries, you’re permanently locked out until IT decides to maybe help you out.
Thats one of two things I hate online with a passion.
Sites that dictate your password and Sites that put a charachter limit on account names.
http://xkcd.com/936/
You beat me to it, +1 to you good sir!
This is exactly what I meant. Except one of my words would be numerals.
Error: Password does not contain any Korean characters
every damned time
Yep!
Error, password must contain the longest word from every language and the value of pi to 20 decimal places.
Judy, smash!
Can’t be any of your last 10 passwords.
Decide to make it F*ckYou1984
True story.
HAHAHA!!! i hate it when that happens! the bottom panel is me after about a minute or so.
After you repeat all these steps in the “forgot password” screens, you can then remember what the password was in the first place…
need password? why not z0IdbErg
You need 2 numbers and 2 uppercase…sorry.
z0lDb3rG is acceptable. lol.
Why is me gusta face there? He does not gusta.
@cameron- thank you, i was like wth does he gusta….
Websites that are too picky about usernames should go to hell!
This sounds just like my job. 8 different programs, all requiring an 8-character password, which must include 1 upper, 1 lower, 2 numbers, 1 special character, no consecutive repetition of characters, and no password that has been used previously. And we’re going to tell you that it’s good for 60 days but we’ll start bugging you to change it in 45.