Re: Password Standards

[Roger A Safian <r-safian () NORTHWESTERN EDU>]

> Many of the responses, the password policy pages particularly, were quite
> similar with only a few notable, but slight differences.  I only saw a couple
> that mentioned how passwords were to be stored by developers and only
> with the vague notion of "encryption".  More guidelines for internal
> developers or third parties might be nice.
> Specifically, detail tools and methods for using and storing a hash and salt,
> syadmins performing password crack audits and so on.

John - Speaking for myself, I was just trying to answer the original question.  The larger question you now pose is 
likely also covered in the mountain of polices most of us have.  As a sample, I give you:

http://www.it.northwestern.edu/policies/softwareauth.html
http://www.it.northwestern.edu/policies/bid.html
http://www.it.northwestern.edu/policies/dataencryption.html

A little dorking on our various websites may yield similar results.