Re: suggesting passwds to users

[Mark Owen <mr.markowen () gmail com>]

> So, when the user is
> at the change password page and about to type in "Mets4Ever" as their
> new password, why not give them a list of 10 or so cryptographically
> strong, randomly generated passwords as suggestions for them.

Given a list of randomly generated or the option of entering a
convienant to remember password, I believe the end user will always
pick their own.  Those who will pick one from your list will surely
write it down to remember later.  I believe the best option for
security in this example is to enforce strict password policies (mix
upper, lower, numeric, and special characters with at least 8 in
total) and prevent the end user to write it down.  I generally advise
users to use something similar of M3ts~4~Ev3r! to remember a complex
password easier.  I would personaly try to stay away from giving them
the option to choose a predefined password due to its difficulty in
recalling.  Another option is to use 2-form authentication.  Mets4Ever
and a token would be an ideal solution.

-- 
Mark Owen