Re: New Password rules at VRM610

[Simon Coulter <shc@xxxxxxxxxxxxxxxxx>]

On 23/04/2008, at 4:14 AM, David Gibbs wrote:
> Of course, one thing that all security administrators need to keep in
> mind is the usability of the password restriction scheme that they  
> choose.
>
> Overly complex password restrictions lead to forgotten passwords,
> passwords on post-it notes, automatically stored passwords, etc.
>
> The more complex security you put in place, the less security you  
> end up
> having.

True, but you can teach users how to compensate and still satisfy  
many requirements. For example, teach them to replace O by 0, I by 1,  
E by 3, etc. Thus you can remove vowels (harder to guess passwords)  
and require at least one digit (harder to guess passwords).


Regards,
Simon Coulter.
--------------------------------------------------------------------
   FlyByNight Software         OS/400, i5/OS Technical Specialists

   http://www.flybynight.com.au/
   Phone: +61 2 6657 8251   Mobile: +61 0411 091 400        /"\
   Fax:   +61 2 6657 8251                                   \ /
                                                             X
                 ASCII Ribbon campaign against HTML E-Mail  / \
--------------------------------------------------------------------