Re:How to enforce password complexity on Linux
by ryandvm on Tuesday May 08, 2012 @11:29AM
(#3944101)
Can we all agree to stop forcing users to jump through these hoops? It's not helping security at all.
Requiring users to have a number, punctuation, mixed case, 10 digits, etc. may make the password itself more secure, but it's all for naught since the user just wrote it down on a Post It note because it's an unmemorable heap of bits.
Just run the username/password through a cracking library and if it doesn't crack then let them use it.
Re:How to enforce password complexity on Linux
by tzs on Tuesday May 08, 2012 @12:13PM
(#3944344)
> Requiring users to have a number, punctuation, mixed case, 10 digits, etc. may make the password itself more secure, but it's all for naught since the user just wrote it down on a Post It note because it's an unmemorable heap of bits.
There is no realistic chance that the people who are interested in finding my passwords will be able to read a Post It note inside my house, so if having to use a more secure password causes me to resort to a Post It note it would not be for naught.
Re:How to enforce password complexity on Linux
by IsTom on Tuesday May 08, 2012 @02:10PM
(#3945050)
If you're setting requirenments on password for yourself then perhaps you've got some problems.
This is matter of security in systems with many users where industrial espionage or social engineering might happen.
Requiring users to have a number, punctuation, mixed case, 10 digits, etc. may make the password itself more secure, but it's all for naught since the user just wrote it down on a Post It note because it's an unmemorable heap of bits.
Just run the username/password through a cracking library and if it doesn't crack then let them use it.
There is no realistic chance that the people who are interested in finding my passwords will be able to read a Post It note inside my house, so if having to use a more secure password causes me to resort to a Post It note it would not be for naught.