Re: Stats re: passwords

["Don M. Blumenthal" <don () DONBLUMENTHAL COM>]

One person that I know in the security community doesn't believe in password
rules like these because they are a pain to type and could be forgotten, if
nothing else wrt whether a letter is capitalized or not. Where the system
allows long pws, he advocates long, easy to remember sentences, such as
IhatestrongpasswordrulesmorethanIhateBrusselssprouts."

Don

-----Original Message-----
From: The EDUCAUSE Security Constituent Group Listserv
[mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of randy marchany
Sent: Friday, October 16, 2009 12:14 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: Re: [SECURITY] Stats re: passwords

After reading Alison's note to the list about password rules, I'm sure
that for most of us, the following password would be valid under
standard password rules of a) 8-16 characters b) upper/lower case c)
at least 1 numeric d) at least 1 special character.

AaBbCcDd1234)(*&

<sigh>

Randy Marchany
VA Tech IT Security Office