We had a password incident in a client of a former employer.
It was a school. All staff and all users had logins into the Intranet system they licensed from us. We had length and expiry checking on the password for a long time.
And then a sizable number of the students discovered a lot of the staff were using their first names as their password.
So at their request, we ran a password cracker over their passwords. There were a lot of *really bad* passwords. A lot of staff got into trouble, particularly those who'd been compromised because they picked a poor password.
We added some stronger password checking after that, mostly the standard checklist items - mixed case, numbers and letters - but it also checked a lot of known information about the user (names, aliases, relatives, phone numbers, etc etc - because the app had it anyway), and it also encouraged long passwords. My boss tested it with a 70 character password at one demonstration. It wasn't foolproof, but it got rid of almost all of the "easy" passwords. We also made sure we pointed out that human stupidity was more to blame.
Wade.
Is it enough to love
Is it enough to breathe
Somebody rip my heart out
And leave me here to bleed
| |
Is it enough to die
Somebody save my life
I'd rather be Anything but Ordinary
Please
| -- "Anything but Ordinary" by Avril Lavigne. |
