RE: "Proactive" Password Checking

[bhe () it aarhus dk]

"Eric Toll" <etoll () syracusesupply com> wrote:
> Just read this password checking thread and a lot of you
> seem to say, some things which seem a bit strange to me.
>
> A complex password does not have to be something like
> "$5dsdDe%AzW3q"  this is hard to crack and hard to
> remember.  (users forgetting or writing it down)
>
> Now consider the password "maryhadalittlelamb"  hard to
> crack, easy to remember, not a problem for dictionary
> crackers.   Just tell users to put a few words
> _together_ for security, like their favorite song lyric
> or something.

You have to consider the redundancy in english (which is
about 50% IIR). So a random password with x characters is
as secure as a password in english with 2x characters!

--
|mvh Bjørn Hee               |Århus Kommunes IT-afdeling   |