4 ms·
I saw some similarly obtuse password policies when working in the defense industry. A coworker who had spent much longer than I had in the industry showed me wh
by jwestbury 4y ago
I saw some similarly obtuse password policies when working in the defense industry. A coworker who had spent much longer than I had in the industry showed me what he called "the waterfall method" of password generation. That is, your password would be something like 1Qaz2Wsx -- a waterfall down the keyboard, if you will. You could always tell when he was typing in his password by the staccato tapping of keys.
Just further proof, really, that overly restrictive password policy leads to users adopting insecure password practices. But we've known that for ages -- and, indeed, the password policies we were grappling with at work were in direct defiance of NIST guidelines about password policy.
- leetrout 4y agoVery common password methodology to remember the pattern on the keyboard like that. The NIST guidelines are really good IMO.
- zmgsabst 4y agoThe hard part was always password generation. That we’ve spent decades trying to add abstruse rules and training people to “do it right!” rather than provide a mechanism speaks to the psychology of security people. Buy people a box of tiny dice; have them make a game of a new pass phrase… that they can actually remember. Eg, this box which fits in your palm — and gets ~50bits per shake. https://zmichaelgehlke.com/images/dicebox.jpg https://zmichaelgehlke.com/images/dicebox.jpg
- zamadatix 4y agoPeople don't want the mechanism either because the root problem is the misaligned incentives in that a secure password is always more work to use compared to an insecure password. Recently the push for passwordless authentication has been tackling that.