-----BEGIN PGP SIGNED MESSAGE-----
On 03/17/2011 08:58 PM, Ricky Zhou wrote:
Hey, so we discussed in the meeting, FAS's password requirements
currently very lax - just a minimum length of 8 characters. What do we
think the requirements should be changed to?
One possible strength checker that I mentioned during the meeting was:
This can use a dictionary to detect weak passwords.
Somewhat tangentially, I'd like to also mention that if we create a set
of minimum password requirements, this should be visible not only on the
password creation page, but also on the password entry pages (even if
it's just a mouse-over of a "?" icon next to the password-entry field).
In my experience, people are prone to forgetting their passwords. The
best hint we can give a person to remember their password (without
requiring them to add a hint message that could reveal information to an
attacker) is to allow them to see which set of rules the password had to
It's an unfortunate truth that many users reuse passwords across
multiple sites. In general, they need to maintain a few categories of
* My password for really low-security sites that I don't care about
* My password for my local computer; just complicated enough so I can
remember it but not easily socially-engineered
* My really secure password for important work stuff
Allowing the user to see that FAS requires e.g. eight or more characters
with at least one capital and one special character would narrow the
above example down (in this case, only P@ssphr@seW|thMany$pecialChars
would meet the requirements, so I'll remember to use that)
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
-----END PGP SIGNATURE-----