Security Basics mailing list archives
Re: Password Management
From: Kelly Martin <kel () securityfocus com>
Date: Fri, 21 Apr 2006 15:49:13 -0400
Jason T. Hallahan wrote:
I read somewhere that the optimal password length for a Windows system is actually 7 alphanumeric characters... can anyone verify or expand on that?
You can find some good insight in the interview we published with Solar Designer, who created the password cracker John the Ripper. Long passwords (or better, passphrases) are definitely better, but if someone can get the LM hash offline it's likely still game over no matter what (given enough resources). http://www.securityfocus.com/columnists/388/2. It's always a balance between a good password and one that the user can actually remember.
My personal view is that it's better to enforce a strong password but don't require that it be changed too often... so many users take a strong password and just enumerate it slightly if it needs to be changed every month.
------------------------------------------------------------------------- This List Sponsored by: WebrootDon't leave your confidential company and customer records un-protected. Try Webroot's Spy Sweeper Enterprise(TM) for 30 days for FREE with no obligation. See why so many companies trust Spy Sweeper Enterprise to eradicate spyware from their networks.
FREE 30-Day Trial of Spy Sweeper Enterprise http://www.webroot.com/forms/enterprise_lead.php --------------------------------------------------------------------------
Current thread:
- Password Management Securi Net (Apr 20)
- Re: Password Management Saqib Ali (Apr 21)
- PenTest Checklist Mr.Hartmann (Apr 21)
- Re: PenTest Checklist Rodrigo Buarque Ramos (Apr 24)
- RE: PenTest Checklist Carl Davis (Apr 26)
- <Possible follow-ups>
- RE: Password Management Chandra, Sharath V Ctr SAF/FMPT (Apr 21)
- RE: Password Management Andrew Williams (Apr 21)
- RE: Password Management Crawley, Jim (Apr 21)
- Re: Password Management Jason T. Hallahan (Apr 21)
- Re: Password Management Kelly Martin (Apr 21)
- Re: Password Management Turk (Apr 24)
- Re: Password Management Micheal Espinola Jr (Apr 24)
- Re: Password Management Jason T. Hallahan (Apr 21)
- RE: Password Management Lorteau Clement (Apr 21)
- Re: Password Management nightwatchman (Apr 21)
- Re: Password Management Bill Cullen (Apr 24)
- Re: Password Management Alexander Bolante (Apr 24)
- Re: Password Management l00t3r (Apr 24)
- RE: Password Management Christopher Carpenter (Apr 24)
- Re: Password Management Stephen John Smoogen (Apr 24)
- RE: Password Management Donald N Kenepp (Apr 25)