Re: Minimum password requirements

[Ansgar -59cobalt- Wiechers <bugtraq () planetcobalt net>]

On 2004-07-19 David Gillett wrote:
> > b. Passwords cannot be changed for at least 14 days.
>
>   With the last 10 being retained, I don't think this one is
> necessary.  And since it could prevent a leaked/compromised password
> from being changed, I'd say it risks decreasing security rather than
> improving it.

IBTD. Users tend to change their password ten times at once, then set
their old password as their new password, if you don't prevent them from
doing so. Also keep in mind that an administrator can change a password
anytime, so even if a password gets compromised, someone will be able to
change it.

Regards
Ansgar Wiechers
-- 
"Those who would give up liberty for a little temporary safety
deserve neither liberty nor safety, and will lose both."
--Benjamin Franklin

---------------------------------------------------------------------------
Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off 
any course! All of our class sizes are guaranteed to be 10 students or less 
to facilitate one-on-one interaction with one of our expert instructors. 
Attend a course taught by an expert instructor with years of in-the-field 
pen testing experience in our state of the art hacking lab. Master the skills 
of an Ethical Hacker to better assess the security of your organization. 
Visit us at: 
http://www.infosecinstitute.com/courses/ethical_hacking_training.html
----------------------------------------------------------------------------