http://qs1969.pair.com?node_id=28110


in reply to RE: RE: RE: Ethics of Passwords
in thread Ethics of Passwords

Take a pseudo-random mix of letters that's pronounceable or has a meaningful association

I would worry that would end up being a dictionary word.

and add several arbitrary numbers that have a pattern

Patterns are easy to find (didn't you see the movie Pi? ;)

stick in a punctuation mark or two

Same as using numbers, simply have to add the punctuation marks into the cracking algorythm.

I'm not knocking you here, just that it is like you are trying to contrive a password creation sheme which isn't random, has a finite number of possabilities (especially when you use letters only in a persons name), and whose patterns could be figured out. There is nothing better (that I know of) than simply giving a totally randomly generated password. When the user changes it to 'ilovecheese', is when there is a problem :) (of course you can set rules against that happening).

at least for low-risk access, like desktop workstations in the marketing department.

That isn't really low risk. I am sure Adidas would like the marketing info from Nike :)

Anyways, we aren't talking about Perl now!

Cheers,
KM