15 character minimum passwords

[Scott Bradner <sob () HARVARD EDU>]

what problem are you trying to solve with 15 character passwords

if you have a limit on incorrect password guesses then going from
8 to 15 characters makes no difference to fighting a guessing attack

the only threats I can see where going to 15 characters would make
a possible difference is watching over someone's shoulder to catch a
password and leaving the password file some place it can be grabbed
for a brute force attack

am I missing something?

the main effect I would predict is pissed off users - and that does not
seem like a security advantage

Scott

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/cg/.