Re: Passphrases v Password

[Rich Graves <rgraves () CARLETON EDU>]

Is this driven by a specific external requirement? 

Unless your current passwords are laughably bad [1], I don't think this should be a priority. Passwords are stolen by 
malware and phishing, not cracking. To protect against sniffing attacks, use later versions of signed CIFS protocols. 
I'd advise you to leave passwords alone and try to get to "2-step verification" where it matters. Use 2-factor to 
protect the highest risk assets, but the "remember this device" strategy employed by Google, Facebook, Evernote, 
Amazon, DropBox, and many banks is pretty good. 

[1] Until 2006, Carleton required passwords of exactly 8 characters, with no other checking. Help desk representatives 
were instructed to set passwords to "carleton" and politely ask users to change them later. A large percentage of users 
did not.