Re: New Password rules at VRM610

[David Gibbs <david@xxxxxxxxxxxx>]

rob@xxxxxxxxx wrote:
> Limiting characters was a good way to forbid words.  Taking out vowels was 
> a common technique.  Removing this capability does not do much for 
> "freedom of choice" for administrators.

Of course, one thing that all security administrators need to keep in 
mind is the usability of the password restriction scheme that they choose.

Overly complex password restrictions lead to forgotten passwords, 
passwords on post-it notes, automatically stored passwords, etc.

The more complex security you put in place, the less security you end up 
having.

david