How to create better passwords & What is a PassPhrase anyway?

re: How to create better passwords & What is a PassPhrase anyway?

Steve Lamb — Fri, 29 Jul 2005 23:26:58 GMT

Dave> Thanks for your very interesting comment. I can see that such a screen saver policy together with a passphrase would be frustrating. Statistically having a ten character passphrase would be a reasonable compromise from a cryptoanalysis perspective. I realise there's a cost implication but smartcard authentication would be less painful with such a screensaver policy. How about increasing the screen saver interval and having forefits for those who get caught by their team with an unlocked screen. I'm sure someone engaged on a long telephone call would be very frustrated if the screen saver cut in whilst they were talking.

What do you think?

re: How to create better passwords & What is a PassPhrase anyway?

Dave Pacheco — Thu, 28 Jul 2005 14:42:22 GMT

While I understand Jesper's point, it seems a little simplistic solution to me, and doesn't take into account the unintended consequences or the "real world" applications. Yes, a thirty character passphrase is more secure than an 6-character "complex" password. But out there are other security measures that conflict with it: specifically, password-protected screensavers. We have policies that enforce the screensaver coming up every 15 minutes, which seems to still be an industry standard for places that have lots of open, public machines. Just as users tend to write down the longer "complex" passwords of random letters, numbers and special characters on a sticky note, they will try to get around having to type in a 30+ character string every 15 minutes. When we tried to enforce 30+ char passphrases, we found that someone had written a program to "jiggle the mouse" every 10 minutes so the screensaver never kicked in, because they were so annoyed at all the typing they had to do every time they stopped using their computer for 15 minutes. This little program got passed around, and soon a ton of people were using it. Yes, tighter controls over the desktop might have prevented this app, but that's not the point of discussion here: it's that there are unintended consequences of the security measures that Jesper espouses, and those don't seem to ever be brought up in his discussions. In particular, the fact that users dislike having to type those long passphrases in over and over again, even when they are simple sentences. Just because I can remember "Mypasswordisthebestpasswordintheworld" easier than "F(5%pr@m1", doesn't mean I prefer typing the former all day long. - Dave Pacheco Manager, Architecure and Security The Walt Disney Company

What do you take to the shower with you....?

John Howard — Wed, 20 Jul 2005 17:36:50 GMT

Answer: A&nbsp;laptop keyboard.
I've been unable to do a lot of work for the past hour or so after spilling...