Re: Please do not change your password

[Morrow Long <morrow.long () YALE EDU>]

Justin -- I heard about Cormac Herley's study on NPR last night:

        Study: Computer Security Measures Not All Worth It
        http://www.npr.org/templates/story/story.php?storyId=125914112

Morrow


On Apr 14, 2010, at 9:04 AM, Justin Sherenco wrote:

> Hello,
> I came across an interesting article on password changes.  Author
> Cormac Herley of Microsoft makes a good case albeit just a cost-
> benefit analysis.  I had to go back and think of why these types of
> policies were created in the first place.  I came to my own
> conclusion that they were created before the days of complex
> password (passphrase) enforcement and the ability to automatically
> lock out accounts after X amount of failed log-in attempts.
>
> Do you think he can convince the auditors?
>
>
> http://www.boston.com/bostonglobe/ideas/articles/2010/04/11/please_do_not_change_your_password/?page=full
>
> Regards,
> Justin
>
>
> -------------------------------------
> Justin Sherenco
> Security Analyst
> 734-487-8574
> Easten Michigan University
> http://it.emich.edu/security