Re: password aging

[HASSAN.KARIM () chase com]

Actually...
This is the policy in alot of Banks. However, I've been hardpressed to find
a Unix implementation that does this. If Im not mistaken, I've heard of
something but I can't remember the name.

-Hassan





Adam Shostack <adam @ weathership.homeport.org> on 08/18/98 05:57:23 PM

Please respond to Adam Shostack <adam () weathership homeport org>


To:   firewall-wizards @ nfr.net
cc:    (bcc: Hassan Karim/CHASE)
Subject:  password aging




     Various people assert that its a good idea to maintain a
history of user passwords so that they can't change their password to
a previous password.  However, I'm having trouble finding a reference
to this in the literature that examines the issue of how many
passwords to save and why.  The lime green book (password management)
says not to let the user use their previous password, but doesn't go
into storing a history.
     Does anyone know of a paper on, or that discusses, this topic,
and how or why to pick various values of N?
Adam