Educause Security Discussion mailing list archives

Re: Please do not change your password


From: Valdis Kletnieks <Valdis.Kletnieks () VT EDU>
Date: Fri, 16 Apr 2010 10:27:54 -0400

On Fri, 16 Apr 2010 08:49:01 CDT, "Tonkin, Derek K" said:

I think a lot of the confusion and difficulty could be reduced by losing the
thinking that each password “if I'm responsible, needs to be different”.  I
think this is one of those areas where the cost vs. risk mitigated is badly out
of balance.  You’ve clearly established that you basically have two sets of
information, sensitive and non-sensitive.  To me that would indicate the need
for two passwords.

Except that in most cases, the "sensitive" information can't be treated as
"sensitive to the same constituency", so it can't be blindly lumped
together as "two sets of info".

Attachment: _bin
Description:


Current thread: