But I should have clarified my thoughts. Notice how I mentioned sticking non-alphanumeric characters into the mix? The scheme I mentioned would not work if it were used precisely every time. But I think it's a good general idea for generating passwords , at least for low-risk access, like desktop workstations in the marketing department.

Take a pseudo-random mix of letters that's pronounceable or has a meaningful association in case it's forgotten, and add several arbitrary numbers that have a pattern (like 6786 or 1641), stick in a punctuation mark or two, and you have a decent, hard-to-break password. But that's just common sense, I guess.

Of course, arbitrary-length passphrases are so much better and easier to remember...

Take a pseudo-random mix of letters that's pronounceable or has a meaningful association

I would worry that would end up being a dictionary word.

and add several arbitrary numbers that have a pattern

Patterns are easy to find (didn't you see the movie Pi? ;)

stick in a punctuation mark or two

Same as using numbers, simply have to add the punctuation marks into the cracking algorythm.

I'm not knocking you here, just that it is like you are trying to contrive a password creation sheme which isn't random, has a finite number of possabilities (especially when you use letters only in a persons name), and whose patterns could be figured out. There is nothing better (that I know of) than simply giving a totally randomly generated password. When the user changes it to 'ilovecheese', is when there is a problem :) (of course you can set rules against that happening).

at least for low-risk access, like desktop workstations in the marketing department.

That isn't really low risk. I am sure Adidas would like the marketing info from Nike :)

Anyways, we aren't talking about Perl now!

Cheers,
KM