Cheers,
KM

SOME people have their passwords on post-its? I remember a certain job I was on for the Air Farce. They had very complicated password requirements. 8 chars, upper and lower case, plus digits and special chars, etc. They would run crack every weekend and reset your password if it was easy to break. The kicker to the whole thing was the little statement at the bottom of the page. To paraphrase, it said - "We realize these requirements will make your password hard to memorize. Therefore, we reccommend writing it down and keeping it in your wallet or desk drawer."
Scary, no?
This was, however, a resctricted access network. As far as a general access network, I tend to agree with KM. I know that having an option to have your password emailed is great, but it still leaves some holes that may or may not worry you depending on what you're protecting.
For example:
• Being able to email a password means that it's still stored in cleartext somewhere unless you're using an encryption scheme that is reversible (not a one-way hash)
• Emailing passwords in cleartext means that somebody could intercept them.

Of course, security always comes at the price of usability, so if a password compromise won't cause major damage (loss of data, credibility, life) clear text may be the best solution.

Being a member of the Air Force Reserves as well as someone
who actually sits in the Base Network Control Center and
changes passwords for people, I can honestly say that I have
NEVER told anyone to write down their password. However, you
are quite correct as to the requirements for our passwords,
which are minimum 8 characters, using uppercase, lowercase,
special characters, and numbers, and you need to use at least
three of the four categories in your password.

For me to actually change your password, you would have to come
to the NCC in person, and present your identification card. At that
point, I would instruct the person as to what the password policy is,
and let them type in their own new password. Or if the person in question called
and is someone who I know, and recognize their voice, I will change the password,
to a generic one, then force them to change it upon logging into the system.


TStanley

I worked for the State of Pennsylvania for a while in their student loan department, and the passwords we had to access the student files had this pattern:
the first letter must be a letter, the second a single digit, and the rest must be a mix of upper and lower case with one punctuation mark somewhere in the mix. Passwords expired every 30 days, and they kept track of the last 30.
Needless to say, the majority of people were not happy with these restrictions, and it was not uncommon to see someone with a sheet of paper listing all of their passwords....

Ivory

If you end up with a user that can't remember their password, you just decrypt it with you private key (kept in a safe place of course). And hand it back to them.

(similar to standard hashes, The only problem, IIRC is that public key algorithms generally don't generate the same results on the same piece of text 2 times in a row.)
   That's deliberate - most PK algorithms add a salt value to the plaintext to avoid any weaknesses due to repeat-encryption. If you just do a plain PK encryption (RSA sounds like a good idea given the patent expires in about a month) then it is repeatable (for hash purposes) and decryptable given the secret key.

   If you would rather stick with something like PGP though, you could always encrypt the password when it is changed, but keep a hash of the password as well for verification.

• Randomly generated a password on account creation
• If password is lost, match secret phrase (mother maiden name, etc ..)
  and reset it with another randomly genereated password.
• Make sure have a explanation on your page as to why you password policy is secure.

/****************************/
  jason@gost.net, wh@ckz.org
    http://jason.gost.net
/*****************************/
[download]

Unfortunately, this is not such a great idea. The average person has a vocabulary of between 2000 and 5000 words (i'm not totally sure about those numbers, but i'm on the same order of magnitude). So assuming you can use up to 5000 words and make things easy to remember (which is the whole point), that gives you a search space of 25,000,000. That would be crackable minutes. Add on two random digits increases the search space by a factor of 100. That gives you 2,500,000,000 passwords to check, which is checkable in an hour or two at the most.

Bottom line is, dictionary words never make secure passwords. English text only has about 1.5 bits of entropy per letter. At work, we strongly discourage our users from using dictionary words from any language

-Mark
mlogan@ccs.neu.edu

So, for example, a user with the name Andrew Johnston would be given a default password of 0714jstn or aw9901Jn, or 28drej82, etc.

Sure, it's not exactly as secure as a fully random password, but it's easier to remember, not as likely to be changed to 'nameofgirlfriend', and still pretty hard to guess -- especially if a couple of $'s or &'s were to be thrown in..

While I was stuck in traffic last night staring at license plates I thought of this post. This is a likely bad idea for a password scheme. Why? Because anyone who knows the scheme can more easily crack a password. If I know you will be using 0-9 in four places, and letters from a name for the rest, I know that if the name is Sam Jones there are only 17 (10 numbers 7 letters, since the s is repeated) possible characters per place, with only 4 of them being digits. So if the password was between 8 and N places, you can do the math to see the finite number of possabilites. And, as some of us know, people don't change easy to remember default passwords unless they are forced to :)

Cheers,
KM

You're right, of course.


But I should have clarified my thoughts. Notice how I mentioned sticking non-alphanumeric characters into the mix? The scheme I mentioned would not work if it were used precisely every time. But I think it's a good general idea for generating passwords , at least for low-risk access, like desktop workstations in the marketing department.


Take a pseudo-random mix of letters that's pronounceable or has a meaningful association in case it's forgotten, and add several arbitrary numbers that have a pattern (like 6786 or 1641), stick in a punctuation mark or two, and you have a decent, hard-to-break password. But that's just common sense, I guess.


Of course, arbitrary-length passphrases are so much better and easier to remember...

Can you give an exact URL? I would NEVER EVER do any password creation with JavaScript, but would like to take a look at the script to see how holey it is.

Cheers,
KM

http://javascript.internet.com/passwords/login-coder.html

She-wolf
"Wha? I don't get it."