My password expired?

[VenomX]

Where I work we need a smart card, a pin number and 4 passwords (2 of which have to be changed frequently and must have letters numbers and nonalphanumeric characters, oh and be mixed case).
I am trained in data security so understand the need (the smart card and pin are for access to confidential patient data for the NHS) but during training it was recommended that we just change the number at the end! A good way to break the system.

I see that as insecure. To remember all that I would have to write all the passwords and pin down.

[Geek King]

I see that as insecure. To remember all that I would have to write all the passwords and pin down.

Actually, I write most of my passwords down, but I do so in code. I keep the key algorithm to my code in my lockbox with my important paperwork (lease agreements, loan papers, insurance agreements, ect.) and in my head. If you saw my code sheet, it would look like a rough draft for a fanfic, or a grocery list. You might be able to break it, but there are easier pickings out there to go after that would take less time.

[technical.angel]

What kind of fanfic?

Jenni, taking this totalllllllllllllly OT.

[trunks2k]

I suggest you get used to the idea. I've worked with companies that issued me a electronic keyfob that had the current password on it. Why? Their password changed every ten minutes. High security medical facility, if you're curious.

Yep, we had those sorts of things way back when I worked at Merck. But they were used for remote network access.

[Fiyero]

I see that as insecure. To remember all that I would have to write all the passwords and pin down.

The passwords don't all have to be different (the pin is a number of course).

I have a system and none of the passwords are written down. even if someone learned my password they wouldn't be able to guess it once changed (unlike adding to a number at the end)

[DannyboyO1]

Man. Love hearing about security systems. Or, well, technically insecurity systems. So many have these arbitrary and distressing requirements where it gets steadily less likely that it'll be something the average person can readily memorize. At which point, they have to write it down.

Defeating half the purpose of the arcane requirements.

Most security just has to use sensible precautions. 3 failures and there's an alert, and you need to talk to IT for a password reset. They call your supervisor, verify you, embarass you, and fix it. This actually does prevent the very brute-force methods that the extra symbols and characters are intended to fix.

I've heard some nice setups for dealing with human memory limitations. Partial passwords, patterns for numerics...

In trying to hunt down an old joke memo from years back including pretty much every artificial password restriction on the planet. (Punchline was "There is actually only one password that meets all of the above requirements, please see your supervisor for it.") I found an article explaining what I've always found silly about so many password requirements.

And, really, if your system administrator cannot protect your system from a brute-force attack (like, say, locking down any attempt with 3 failures.); they should be fired.

Love the bit about the keychain dongle for the 10-min passwords, Geek King. 'course, technically, that's not a password. That's a key. Same system that's used in hotels, when you get down to the basics.

[Geek King]

What kind of fanfic?

Jenni, taking this totalllllllllllllly OT.

The last one I used was one my friend was working on. It was a "what if" type of fanfic dealing with what might have happened if Louise the wizard (from the anime whose tile is being translated as "Louise's Familiar" or "Zero's familiar") had summoned Dark Schnieder from the Bastard!! universe as her familliar, rather than the guy from the anime/manga. I think he's still working on it.

Currently, I have a list of ingrediants for white chicken chili serving as a password list. Sorry to dissapoint.

[Cyphr]

I <3 "Zero no Tsukaima"/"Zero's Familar" That show rocks i feel sorry for saito getting exploded every episode though