Re: Linking Password Length to Write-down probability

[Gonzalo Martinez <karmax () gmail com>]

Hi Stian

A few days ago i read a post at slashdot:

"Microsoft's senior program manager for security policy, Jesper
Johansson, presents a provocative but interesting view on password
policy: He claims that prohibiting users from writing down their
passwords is bad for security. His main point is that if users are
prohibited from writing down their passwords, they will use the same
easy to guess password everywhere." From the article: "Since not all
systems allow good passwords, I am going to pick a really crappy one,
use it everywhere and never change it...If I write them down and then
protect the piece of paper--or whatever it is I wrote them down
on--there is nothing wrong with that. That allows us to remember more
passwords and better passwords."
http://it.slashdot.org/article.pl?sid=05/05/24/2047228&tid=172

IMHO as a good BOFH you _MUST_ requiere that all employes use an
alphanumeric password (8 or 10 chars minimun)... if they dont his
emails, files, or anything else can be redirected to /dev/null ;)
No, seriously, i never heard of a "scientific analytical/statistical
research"  about this subject.
But take a look at the post on slashdot

good bye

-- 
Gonzalo Martinez

On 5/26/05, Stian Øvrevåge <sovrevage () gmail com> wrote:
> God morning list!
>
> I continually read papers which advertise increased password lenghts (
> and outrageous complexity requirements ) as The Solution(TM). I work
> in a fairly large organization and I can safely acknowledge that even
> 8 character passwords with moderate complexity requirements are VERY
> prone to beeing written un-encrypted and un-hashed on Post-Its, and
> then safely contained, under the keyboard, or on the monitor. Which in
> my humble oppinion is bordering to "stupid security".
>
> I'm certain that there is a link between required password lenght and
> complexity and the probability of users taking the huge leap backwards
> and writing passwords down.
>
> I've been doing a little Googling, but I can't seem to find any
> scientific analytical/statistical research done on this particular
> subject. Is anyone out there aware of any works done in this field? If
> not, is there anyone intrested in conducting such a survey on the
> behalf of the community?
>
> Regards, Stian