Re: Password policy

[Jeff Kell <jeff-kell () UTC EDU>]

Geoff Nathan wrote:
> But seriously, who's going to try to break into Professor Snerdwell's
> e-mail account with a dictionary attack?  And unless we're worried
> about month-long sustained attacks, frequent password changes are just
> annoying without buying additional security.  Making people change
> their passwords every ninety days doesn't teach good computer hygiene,
> it annoys them and confirms their impression that the IT people have
> nothing better to do.

Hear, hear!

Hackers don't crack passwords anymore, they simply present a
socially-engineered URL for the already-authenticated user to click on
for a drive-by install of the backdoor/keylogger of his choice.

Jeff