In my opinion? No. On the other hand, overly complex password rules encourage people to write them down on PostIts™, which doesn't tend to improve security.

I have always wondered what the big deal was about writing passwords down. I do it all the time, if it's something I have problems remembering. Then I put it in my wallet. If I really need to look at my password, it's right there, as safe as my wallet. If someone gets hold of my wallet, they still wouldn't know what the passwords were for, unless it was a co-worker or something.

Now I use my cat's name for a password. But his name is zo4WQfoenc32G, and I change his name weekly.

Writing your password down and taping it to your monitor is probably a trifle less secure than your wallet.

I could say that your cat's name would be tough to pronounce, but it probably makes no difference what you call a cat; they don't come when they're called.

emc

"Being forced to write comments actually improves code, because it is easier to fix a crock than to explain it. "
—G. Steele

There are, however, very good reasons to require some variance in character class (say, use at least 3 from: a-z, A-Z, 0-9, << the set of all other ascii characters, which would look ugly in char class notation, plus space >>).

It all boils down to one basic fact - the more difficult it is to brute force a password, the less difficult it is to get your hands on it through social engineering. I still say that a short password with lockout on double failure is more secure than any long password. Just be sure to encrypt it using a different key for every user (registration time + user name + some overall server key, perhaps), or someone with access to the database could match their hash to the hash of every other user, and gain access to people with the same password.

There's also the little matter of people tending to use the same password everywhere, which means that while your security may be infinite, the next place over could leak passwords like a sieve. This is another reason to assign passwords rather than letting people choose them, which means in turn that a short password is better than a long one.

The vast majority of security leaks are from people writing their passwords down

Yeah, and when you limit passwords to 8 characters, people feel compelled to include upper and lowercase characters, numbers, and punctuation, resulting in passwords that are impossible to remember, so they write them down. A longer password made out of three or four words is A) harder to brute-force if someone should happen to try and B) substantially easier to remember.

The traditional reason to limit passwords to 8 characters was because with primitive hashing algorithms used in the 1940s (partly due to the limits of what processors could handle at the time) only the first few characters were significant anyway, so a longer password would provide a false sense of security. In modern times, longer passwords should be allowed if the password hashing algorithm can handle them.

---

Sanity? Oh, yeah, I've got all kinds of sanity. In fact, I've developed whole new kinds of sanity. Why, I've got so much sanity it's driving me crazy.

Hear! Hear! Using a 24-character passphrase that is all lower-case letters and spaces is still more secure than and eight-character monstrosity, mainly for the reason that it's easier to remember (and probably easier to type).

Furthermore, long passphrases are known to be workarounds for known vulnerabilities in security systems. Passphrases 20 characters or longer are significantly harder to crack in WPA-PSK. Passphrases longer than 14 characters have no LANMAN has in Windows (MUCH MUCH harder to crack).

Enforcing a larger minimum length is more important than making stern complexity requirements.

Simple proof: You care how long your encryption keys are, not how complex they are.

--J