3 ms·

Meh, that's a GPO setting. Don't turn it on if you don't like it. Bill Gates isn't holding a gun to your head here. Hell, its not even turned on by default! AD

Meh, that's a GPO setting. Don't turn it on if you don't like it. Bill Gates isn't holding a gun to your head here. Hell, its not even turned on by default! AD can handle long passphrases. Granted, its cryptography only considers the first 14 characters, but I've read case studies where shops have moved away from complexity to minimum 14 characters and suddenly things like password resets become a thing of the past. Turns out its easier for humans to process "mydogsnameismrmittens" vs "M1tt3ns" I've tried long passphrases in embedded devices like cameras and routers. Most of the time they can't handle it. Don't knock AD as being the bad guy here. Go after the nightmarish cockup that defines the security of consumer embedded world.

freehunter 12y ago
I understand it's not actually the fault of that particular setting, it's the fault of the admins using it as a set-it-and-forget-it action. Specially my experience lies in PCI audits, where PCI DSS requirement 8.5.11 says to use passwords containing both numeric and alphabetic characters. 8.5.10 requires a password length of 7 characters. When you need to meet PCI standard, are you going to set your password policy by hand or just turn on AD's default secure password policy? The password policy which is terrible, but meets PCI requirements and makes the boss happy? And even if you make a policy that meets PCI requirements, I've been in many-a PCI audit where the auditor doesn't want to move past the password policy section if you don't use AD's 'strong password' feature. Because it takes a bit of time and effort to explain your password policy without that little checkbox. It's not Microsoft's fault that everyone uses their strong password checkbox. But Microsoft could move into the 21st century and make sure that what they label as 'strong passwords' actually meet the criteria of being strong passwords.

freehunter 12y ago

I understand it's not actually the fault of that particular setting, it's the fault of the admins using it as a set-it-and-forget-it action. Specially my experience lies in PCI audits, where PCI DSS requirement 8.5.11 says to use passwords containing both numeric and alphabetic characters. 8.5.10 requires a password length of 7 characters. When you need to meet PCI standard, are you going to set your password policy by hand or just turn on AD's default secure password policy? The password policy which is terrible, but meets PCI requirements and makes the boss happy? And even if you make a policy that meets PCI requirements, I've been in many-a PCI audit where the auditor doesn't want to move past the password policy section if you don't use AD's 'strong password' feature. Because it takes a bit of time and effort to explain your password policy without that little checkbox. It's not Microsoft's fault that everyone uses their strong password checkbox. But Microsoft could move into the 21st century and make sure that what they label as 'strong passwords' actually meet the criteria of being strong passwords.